WO2021238256A1 - 一种应用隔离方法、系统、设备及计算机可读存储介质 - Google Patents

一种应用隔离方法、系统、设备及计算机可读存储介质 Download PDF

Info

Publication number
WO2021238256A1
WO2021238256A1 PCT/CN2021/073438 CN2021073438W WO2021238256A1 WO 2021238256 A1 WO2021238256 A1 WO 2021238256A1 CN 2021073438 W CN2021073438 W CN 2021073438W WO 2021238256 A1 WO2021238256 A1 WO 2021238256A1
Authority
WO
WIPO (PCT)
Prior art keywords
policy
isolation
rule
component
network security
Prior art date
Application number
PCT/CN2021/073438
Other languages
English (en)
French (fr)
Inventor
张强
刘正伟
Original Assignee
浪潮电子信息产业股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 浪潮电子信息产业股份有限公司 filed Critical 浪潮电子信息产业股份有限公司
Priority to US17/928,113 priority Critical patent/US20230208881A1/en
Publication of WO2021238256A1 publication Critical patent/WO2021238256A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application

Definitions

  • the present invention relates to the technical field of application isolation, and more specifically, to an application isolation method, system, device, and computer-readable storage medium.
  • Kubernetes referred to as K8s, is an abbreviation of 8 instead of 8 characters "ubernete". It is an open source, used to manage containerized applications on multiple hosts in the cloud platform. The goal of Kubernetes is to make deployment containerized. The application is simple and efficient. Kubernetes provides a mechanism for application deployment, planning, updating, and maintenance.
  • This application is to provide an application isolation method, which can solve the technical problem of how to realize application isolation in Kubernetes to a certain extent.
  • This application also provides an application isolation system, equipment, and computer-readable storage medium.
  • An application isolation method includes:
  • the target application is isolated based on the Iptables rule.
  • said creating an initial network security policy corresponding to said target application includes:
  • the matching label of the initial network security policy is set as a set of identities of all components in the target application.
  • the modifying the stacking rule, the stacking rule and the matching label of the initial network security policy based on the isolation policy includes:
  • the accessed policy represents a policy for other components to access the component of the target application
  • the active access policy represents a policy for the component of the target application to access other components
  • the modifying the stacking rule based on the accessed policy in the isolation policy includes:
  • the modifying the stacking rule based on the active access policy in the isolation policy includes:
  • the method further includes:
  • the calicocontroller in the calico network plug-in is set to run in a stateless load mode.
  • the identifier of the component includes a label of the component.
  • An application isolation system including:
  • the first determination module is used to determine the target application to be isolated in Kubernetes
  • the first obtaining module is used to obtain the isolation strategy of each component in the target application
  • the first creation module is used to create an initial network security policy corresponding to the target application
  • the first modification module is configured to modify the stacking rules, stacking rules, and matching tags of the initial network security policy based on the isolation policy to obtain a target network security policy;
  • the first conversion module is configured to convert the target network security policy into an Iptables rule matching the Kubernetes;
  • the first isolation module is configured to isolate the target application based on the Iptables rule.
  • An application isolation device including:
  • Memory used to store computer programs
  • the processor is used to implement the steps of the application isolation method as described in any one of the above when executing the computer program.
  • a computer-readable storage medium in which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above application isolation methods are realized.
  • the application isolation method provided by this application determines the target application to be isolated in Kubernetes; obtains the isolation strategy of each component in the target application; creates an initial network security policy corresponding to the target application; and modifies the initial network security policy based on the isolation policy
  • the stacking rule, the stacking rule and the matching label are used to obtain the target network security policy; the target network security policy is converted into an Iptables rule matching Kubernetes; the target application is isolated based on the Iptables rule.
  • the stacking rules, stacking rules, and matching tags of the initial network security policy can be modified according to the isolation strategy of the component to obtain a target network security policy that matches the isolation policy, and then the target network security policy is converted to match Kubernetes Based on the Iptables rules, the target application can be isolated based on the Iptables rules, and the application in Kubernetes can be isolated.
  • the application isolation system, device, and computer-readable storage medium provided by this application also solve the corresponding technical problems.
  • FIG. 1 is a flowchart of an application isolation method provided by an embodiment of this application
  • FIG. 2 is a schematic structural diagram of an application isolation system provided by an embodiment of this application.
  • FIG. 3 is a schematic structural diagram of an application isolation device provided by an embodiment of this application.
  • FIG. 4 is a schematic diagram of another structure of an application isolation device provided by an embodiment of the application.
  • FIG. 1 is a flowchart of an application isolation method provided by an embodiment of the application.
  • Step S101 Determine the target application to be isolated in Kubernetes.
  • the target application to be isolated in Kubernetes can be determined first.
  • the type and number of target applications can be determined according to actual needs, and the target application to be isolated can be specified by users, etc.
  • Step S102 Obtain the isolation strategy of each component in the target application.
  • the isolation strategy of each component in the target application can be obtained, and the isolation strategy can also be specified by the user.
  • Step S103 Create an initial network security policy corresponding to the target application.
  • an initial network security policy (NetWorkPolicy) corresponding to the target application can be created to isolate each component of the target application, such as complete isolation or complete disclosure, etc. .
  • Step S104 Modify the stacking rules, stacking rules and matching tags of the initial network security policy based on the isolation strategy to obtain the target network security policy.
  • the stacking rules of the initial network policy can restrict other components from accessing the access information of the components
  • the stacking rules can restrict the components from accessing the access information of other components
  • the matching tags can restrict the identity information of other components.
  • Step S105 Convert the target network security policy into an Iptables rule matching Kubernetes.
  • Step S106 Isolate the target application based on Iptables rules.
  • the target network security policy can be converted into Iptables rules matching Kubernetes, and the target application can be isolated based on the Iptables rules to achieve application isolation of the target application in Kubernetes.
  • the Iptables rule is an IP packet filtering system integrated with the latest version 3.5 Linux kernel. If the Linux system is connected to the Internet or a LAN, a server or a proxy server that connects the LAN (Local Area Network) and the Internet, the system is beneficial to the Linux system Better control over IP packet filtering and firewall configuration.
  • the application isolation method provided by this application determines the target application to be isolated in Kubernetes; obtains the isolation strategy of each component in the target application; creates an initial network security policy corresponding to the target application; and modifies the initial network security policy based on the isolation policy
  • the stacking rule, the stacking rule and the matching label are used to obtain the target network security policy; the target network security policy is converted into an Iptables rule matching Kubernetes; the target application is isolated based on the Iptables rule.
  • the stacking rules, stacking rules, and matching tags of the initial network security policy can be modified according to the isolation strategy of the component to obtain a target network security policy that matches the isolation policy, and then the target network security policy is converted to match Kubernetes Based on the Iptables rules, the target application can be isolated based on the Iptables rules, and the application in Kubernetes can be isolated.
  • the steps of creating an initial network security policy corresponding to the target application can be specifically: creating an initial network security policy; setting the pod selector (podSelecttor) field of the initial network security policy to The form of the match expression (matchExpression); set the operator value of the initial network security policy to the conditional operator In; set the match label of the initial network security policy to the set of the identities of all components in the target application.
  • the identities can be separated by commas, which can reduce the number of NetWorkPolicy, thereby avoiding the host computer
  • the efficiency problem caused by the creation of a large number of Iptables rules in addition, after the initial network security policy is set according to the above operations, the current application is in a completely isolated state, that is, no traffic is allowed to enter the application, and no traffic is allowed to flow out. Current application.
  • the application isolation method provided by the embodiment of the present application is to modify the stacking rule, the stacking rule and the matching label of the initial network security policy based on the isolation strategy, which can be specifically as follows: modifying the stacking rule based on the accessed policy in the isolation strategy ; Modify the stacking rules based on the active access strategy in the isolation strategy; set the value of the matching tag as the identifier of the component to be isolated in the isolation strategy; where the accessed strategy represents the strategy of other components accessing the target application component; the active access strategy Characterize the strategy for the component of the target application to access other components.
  • the access strategy can set the access strategy, active access strategy, and the identity of the isolated component in the isolation strategy, and then you can directly modify the stacking rules based on the accessed strategy in the isolation strategy, and modify the stacking based on the active access strategy in the isolation strategy.
  • the value of the matching tag is set as the identifier of the isolated component in the isolation policy, so as to quickly complete the modification of the initial network security policy.
  • the process of modifying the stacking rule based on the accessed policy in the isolation policy can be specifically as follows: determining the first component corresponding to the accessed policy; modifying the port number corresponding to the first component in the stacking rule to be The corresponding port number in the access policy; modify the network data exchange rule corresponding to the first component in the stacking rule to the corresponding network data exchange rule in the accessed policy; modify the pod selector field corresponding to the first component in the stacking rule For matchlabel, set the value of matchlabel to the identifier of the corresponding other component in the accessed policy.
  • the steps of modifying the pop rule based on the active access policy in the isolation strategy can be specifically: determine the second component corresponding to the active access policy; modify the port number corresponding to the second component in the pop rule to active Corresponding port number in the access policy; modify the network data exchange rule corresponding to the second component in the pop rule to the corresponding network data exchange rule in the active access policy; modify the pod selector field corresponding to the second component in the pop rule For matchlabel, set the value of matchlabel to the identifier of the corresponding other component in the active access policy.
  • the calico network plug-in in order to enable communication between applications in Kubernetes, before determining the target application to be isolated in Kubernetes, the calico network plug-in can also be deployed in Kubernetes; the calico network plug-in The calico node is set to run in demonest mode; the calicocontroller in the calico network plug-in is set to run in stateless load mode.
  • calico is a pure three-layer protocol that provides multi-host communication for Docker containers. It is a pure three-layer method that uses virtual routes instead of virtual exchanges. Each virtual route is transmitted through the BGP protocol (Border Gateway Protocol). Reachable information (routing) to the remaining data centers.
  • BGP protocol Border Gateway Protocol
  • the identification of the component may include the label of the component and so on.
  • FIG. 2 is a schematic structural diagram of an application isolation system provided by an embodiment of the application.
  • the first determining module 101 is used to determine the target application to be isolated in Kubernetes
  • the first obtaining module 102 is used to obtain the isolation strategy of each component in the target application
  • the first creation module 103 is used to create an initial network security policy corresponding to the target application
  • the first modification module 104 is configured to modify the stacking rules, stacking rules, and matching tags of the initial network security policy based on the isolation policy to obtain the target network security policy;
  • the first conversion module 105 is used to convert the target network security policy into Iptables rules matching Kubernetes;
  • the first isolation module 106 is used to isolate the target application based on Iptables rules.
  • the first creation module may include:
  • the first creation unit is used to create an initial network security policy
  • the first setting unit is used to set the pod selector field of the initial network security policy to the form of a matching expression
  • the second setting unit is used to set the operator value of the initial network security policy to the conditional operator In;
  • the third setting unit is used to set the matching label of the initial network security policy as a collection of the identities of all components in the target application.
  • the first modification module may include:
  • the first modification sub-module is used to modify the stacking rule based on the accessed policy in the isolation policy
  • the second modification sub-module is used to modify the stacking rules based on the active access strategy in the isolation strategy
  • the first setting submodule is used to set the value of the matching tag as the identifier of the isolated component in the isolation policy
  • the accessed policy represents the policy of other components to access the component of the target application
  • the active access policy represents the policy of the component of the target application to access other components.
  • the first modification submodule may include:
  • the first determining unit is used to determine the first component corresponding to the accessed policy
  • the first modification unit is used to modify the port number corresponding to the first component in the stacking rule to the corresponding port number in the accessed policy;
  • the second modification unit is configured to modify the network data exchange rule corresponding to the first component in the stacking rule to the corresponding network data exchange rule in the accessed policy;
  • the third modification unit is used to modify the pod selector field corresponding to the first component in the stacking rule to matchlabel, and set the value of matchlabel to the identifier of the corresponding other component in the accessed policy.
  • the second modification sub-module may include:
  • the second determining unit is used to determine the second component corresponding to the active access strategy
  • the fourth modification unit is used to modify the port number corresponding to the second component in the pop rule to the corresponding port number in the active access policy
  • the fifth modification unit is used to modify the network data exchange rule corresponding to the second component in the pop rule to the corresponding network data exchange rule in the active access policy;
  • the sixth modification unit is used to modify the pod selector field corresponding to the second component in the pop rule to matchlabel, and set the value of matchlabel to the identifier of the corresponding other component in the active access policy.
  • the first deployment module is used to deploy the calico network plug-in in Kubernetes before the first determination module determines the target application to be isolated in Kubernetes;
  • the first setting module is used to set the calico node in the calico network plug-in to run in the demonest mode
  • the second setting module is used to set the calicocontroller in the calico network plug-in to run in a stateless load mode.
  • the identification of a component may include a label of the component.
  • FIG. 3 is a schematic structural diagram of an application isolation device provided by an embodiment of the application.
  • An application isolation device provided by an embodiment of the present application includes a memory 201 and a processor 202.
  • the memory 201 stores a computer program.
  • the processor 202 executes the computer program, the following steps are implemented:
  • An application isolation device provided by an embodiment of the present application includes a memory 201 and a processor 202.
  • a computer program is stored in the memory 201.
  • the processor 202 executes the computer program, the following steps are implemented: create an initial network security policy;
  • the pod selector field of is set to the form of a matching expression;
  • the operator value of the initial network security policy is set to the conditional operator In;
  • the matching label of the initial network security policy is set to the set of identities of all components in the target application.
  • An application isolation device provided by an embodiment of the present application includes a memory 201 and a processor 202.
  • the memory 201 stores a computer program.
  • the processor 202 executes the computer program, the following steps are implemented: modify the stack based on the accessed policy in the isolation policy Rules; modify the stacking rule based on the active access strategy in the isolation strategy; set the value of the matching tag as the identifier of the component to be isolated in the isolation strategy; among them, the accessed strategy characterizes the strategy of other components accessing the target application component; active access The strategy characterizes the strategy for the component of the target application to access other components.
  • An application isolation device provided by an embodiment of the present application includes a memory 201 and a processor 202.
  • the memory 201 stores a computer program.
  • the processor 202 executes the computer program, the following steps are implemented: determine the first component corresponding to the accessed policy ; Modify the port number corresponding to the first component in the stacking rule to the corresponding port number in the accessed policy; modify the network data exchange rule corresponding to the first component in the stacking rule to the corresponding network data exchange rule in the accessed policy ; Modify the pod selector field corresponding to the first component in the stacking rule to matchlabel, and set the value of matchlabel to the identifier of the corresponding other component in the accessed policy.
  • An application isolation device provided by an embodiment of the present application includes a memory 201 and a processor 202.
  • the memory 201 stores a computer program.
  • the processor 202 executes the computer program, the following steps are implemented: determine the second component corresponding to the active access strategy ; Modify the port number corresponding to the second component in the pop rule to the corresponding port number in the active access policy; modify the network data exchange rule corresponding to the second component in the pop rule to the corresponding network data exchange rule in the active access policy ; Modify the pod selector field corresponding to the second component in the pop rule to matchlabel, and set the value of matchlabel to the identifier of the corresponding other component in the active access policy.
  • An application isolation device provided by an embodiment of the present application includes a memory 201 and a processor 202.
  • the memory 201 stores a computer program.
  • the processor 202 executes the computer program, the following steps are implemented: Before determining the target application to be isolated in Kubernetes, Deploy the calico network plug-in in Kubernetes; set the calico node in the calico network plug-in to run in demonest mode; set the calicocontroller in the calico network plug-in to run in stateless load mode.
  • An application isolation device provided by an embodiment of the present application includes a memory 201 and a processor 202.
  • a computer program is stored in the memory 201.
  • the processor 202 executes the computer program, the following steps are implemented: the component identification includes the component label.
  • another application isolation device may further include: an input port 203 connected to the processor 202 for transmitting commands input from the outside to the processor 202;
  • the display unit 204 is used to display the processing result of the processor 202 to the outside;
  • the communication module 205 connected to the processor 202 is used to implement the communication between the application isolation device and the outside.
  • the display unit 204 may be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module 205 includes but is not limited to mobile high-definition link technology (HML), universal serial bus (USB), high-definition multimedia interface (HDMI), Wireless connection: wireless fidelity technology (WiFi), Bluetooth communication technology, low-power Bluetooth communication technology, communication technology based on IEEE802.11s.
  • HML mobile high-definition link technology
  • USB universal serial bus
  • HDMI high-definition multimedia interface
  • WiFi wireless fidelity technology
  • Bluetooth communication technology low-power Bluetooth communication technology
  • communication technology based on IEEE802.11s IEEE802.11s.
  • An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:
  • An embodiment of the present application provides a computer-readable storage medium in which a computer program is stored.
  • the computer program When the computer program is executed by a processor, the following steps are implemented: create an initial network security policy; select the pod of the initial network security policy The operator field is set to the form of a matching expression; the operator value of the initial network security policy is set to the conditional operator In; the matching label of the initial network security policy is set to the set of identities of all components in the target application.
  • An embodiment of the present application provides a computer-readable storage medium in which a computer program is stored.
  • the following steps are implemented: modify the stacking rule based on the accessed policy in the isolation policy;
  • the active access strategy in the isolation strategy modifies the stacking rule;
  • the value of the matching tag is set as the identifier of the component to be isolated in the isolation strategy; among them, the accessed strategy characterizes the strategy of other components accessing the target application component; the active access strategy characterizes the target Strategies for the applied components to access other components.
  • An embodiment of the present application provides a computer-readable storage medium in which a computer program is stored.
  • the computer program is executed by a processor, the following steps are implemented: determine the first component corresponding to the accessed policy;
  • the port number corresponding to the first component in the stack rule is modified to the corresponding port number in the accessed policy;
  • the network data exchange rule corresponding to the first component in the stacking rule is modified to the corresponding network data exchange rule in the accessed policy;
  • the pod selector field corresponding to the first component in the stack rule is modified to matchlabel, and the value of matchlabel is set to the identifier of the corresponding other component in the accessed policy.
  • An embodiment of the present application provides a computer-readable storage medium in which a computer program is stored.
  • the computer program When the computer program is executed by a processor, the following steps are implemented: determine the second component corresponding to the active access policy; Modify the port number corresponding to the second component in the stack rule to the corresponding port number in the active access policy; modify the network data exchange rule corresponding to the second component in the stack rule to the corresponding network data exchange rule in the active access policy;
  • the pod selector field corresponding to the second component in the stack rule is modified to matchlabel, and the value of matchlabel is set to the identifier of the corresponding other component in the active access policy.
  • An embodiment of the present application provides a computer-readable storage medium in which a computer program is stored.
  • the computer program is executed by a processor, the following steps are implemented: before the target application to be isolated in Kubernetes is determined, in Kubernetes Deploy the calico network plug-in; set the calico node in the calico network plug-in to run in demonest mode; set the calicocontroller in the calico network plug-in to run in stateless load mode.
  • An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: the identification of the component includes the label of the component.
  • RAM random access memory
  • ROM read-only memory
  • EEPROM electrically programmable ROM
  • EEPly erasable programmable ROM registers
  • hard disks hard disks
  • removable disks or CD-ROMs , Or any other form of storage medium known in the technical field.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种应用隔离方法、系统、设备及计算机可读存储介质，确定出Kubernetes中待隔离的目标应用; 获取目标应用中各个组件的隔离策略; 创建与目标应用对应的初始网络安全策略; 基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略; 将目标网络安全策略转换为与Kubernetes匹配的Iptables规则; 基于Iptables规则对目标应用进行隔离。本申请中，根据组件的隔离策略修改初始网络安全策略，得到与隔离策略相符的目标网络安全策略，并且之后将目标网络安全策略转换为与Kubernetes匹配的Iptables规则，实现了对Kubernetes中应用的隔离。

Description

一种应用隔离方法、系统、设备及计算机可读存储介质
本申请要求于2020年5月27日提交中国专利局、申请号为202010461867.2、发明名称为“一种应用隔离方法、系统、设备及计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及应用隔离技术领域，更具体地说，涉及一种应用隔离方法、系统、设备及计算机可读存储介质。
背景技术
Kubernetes，简称K8s，是用8代替8个字符“ubernete”而成的缩写，是一个开源的，用于管理云平台中多个主机上的容器化的应用，Kubernetes的目标是让部署容器化的应用简单并且高效(powerful),Kubernetes提供了应用部署，规划，更新，维护的一种机制。
在Kubernetes的应用过程中，有时处于安全、限制网络流量的目的，需要控制实体之间的联连通性，比如对应用进行隔离等，而现有技术中并未有对应用进行隔离的方法。
综上所述，如何实现Kubernetes内的应用隔离是目前本领域技术人员亟待解决的问题。
发明内容
本申请的目的是提供一种应用隔离方法，其能在一定程度上解决如何实现Kubernetes内的应用隔离的技术问题。本申请还提供了一种应用隔离系统、设备及计算机可读存储介质。
为了实现上述目的，本申请提供如下技术方案：
一种应用隔离方法，包括：
确定出Kubernetes中待隔离的目标应用；
获取所述目标应用中各个组件的隔离策略；
创建与所述目标应用对应的初始网络安全策略；
基于所述隔离策略修改所述初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；
将所述目标网络安全策略转换为与所述Kubernetes匹配的Iptables规则；
基于所述Iptables规则对所述目标应用进行隔离。
优选的，所述创建与所述目标应用对应的初始网络安全策略，包括：
创建所述初始网络安全策略；
将所述初始网络安全策略的pod选择器字段设置为匹配表达式的形式；
将所述初始网络安全策略的operator值设为条件运算符In；
将所述初始网络安全策略的所述匹配标签设置为所述目标应用中所有组件的标识的集合。
优选的，所述基于所述隔离策略修改所述初始网络安全策略的入栈规则、出栈规则和匹配标签，包括：
基于所述隔离策略中的被访问策略修改所述入栈规则；
基于所述隔离策略中的主动访问策略修改所述出栈规则；
将所述匹配标签的值设置为所述隔离策略中被隔离的组件的标识；
其中，所述被访问策略表征其他组件访问所述目标应用的组件的策略；所述主动访问策略表征所述目标应用的组件访问其他组件的策略。
优选的，所述基于所述隔离策略中的被访问策略修改所述入栈规则，包括：
确定出与所述被访问策略对应的第一组件；
将所述入栈规则中所述第一组件对应的端口号修改为所述被访问策略中的对应端口号；
将所述入栈规则中所述第一组件对应的网络数据交换规则修改为所述被访问策略中的对应网络数据交换规则；
将所述入栈规则中所述第一组件对应的pod选择器字段修改为matchlabel，将所述matchlabel的值设置为所述被访问策略中对应的其他组 件的标识。
优选的，所述基于所述隔离策略中的主动访问策略修改所述出栈规则，包括：
确定出与所述主动访问策略对应的第二组件；
将所述出栈规则中所述第二组件对应的端口号修改为所述主动访问策略中的对应端口号；
将所述出栈规则中所述第二组件对应的网络数据交换规则修改为所述主动访问策略中的对应网络数据交换规则；
将所述出栈规则中所述第二组件对应的pod选择器字段修改为matchlabel，将所述matchlabel的值设置为所述主动访问策略中对应的其他组件的标识。
优选的，所述确定出Kubernetes中待隔离的目标应用之前，还包括：
在所述Kubernetes中部署calico网络插件；
将所述calico网络插件中的calico node设置为以demonest方式运行；
将所述calico网络插件中的calicocontroller设置为以无状态负载方式运行。
优选的，所述组件的标识包括所述组件的标签。
一种应用隔离系统，包括：
第一确定模块，用于确定出Kubernetes中待隔离的目标应用；
第一获取模块，用于获取所述目标应用中各个组件的隔离策略；
第一创建模块，用于创建与所述目标应用对应的初始网络安全策略；
第一修改模块，用于基于所述隔离策略修改所述初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；
第一转换模块，用于将所述目标网络安全策略转换为与所述Kubernetes匹配的Iptables规则；
第一隔离模块，用于基于所述Iptables规则对所述目标应用进行隔离。
一种应用隔离设备，包括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序时实现如上任一项所述应用隔离方 法的步骤。
一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，所述计算机程序被处理器执行时实现如上任一所述应用隔离方法的步骤。
本申请提供的一种应用隔离方法，确定出Kubernetes中待隔离的目标应用；获取目标应用中各个组件的隔离策略；创建与目标应用对应的初始网络安全策略；基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；将目标网络安全策略转换为与Kubernetes匹配的Iptables规则；基于Iptables规则对目标应用进行隔离。本申请中，可以根据组件的隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到与隔离策略相符的目标网络安全策略，并且之后将目标网络安全策略转换为与Kubernetes匹配的Iptables规则，从而可以基于Iptables规则对目标应用进行隔离，实现了对Kubernetes中应用的隔离。本申请提供的一种应用隔离系统、设备及计算机可读存储介质也解决了相应技术问题。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图。
图1为本申请实施例提供的一种应用隔离方法的流程图；
图2为本申请实施例提供的一种应用隔离系统的结构示意图；
图3为本申请实施例提供的一种应用隔离设备的结构示意图；
图4为本申请实施例提供的一种应用隔离设备的另一结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例， 而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
请参阅图1，图1为本申请实施例提供的一种应用隔离方法的流程图。
本申请实施例提供的一种应用隔离方法，可以包括以下步骤：
步骤S101：确定出Kubernetes中待隔离的目标应用。
实际应用中，可以先确定出Kubernetes中待隔离的目标应用，目标应用的类型及数量均可以根据实际需要确定，且待隔离的目标应用可以由用户等进行指定。
步骤S102：获取目标应用中各个组件的隔离策略。
实际应用中，在确定出Kubernetes中待隔离的目标应用之后，便可以获取目标应用中各个组件的隔离策略，隔离策略也可以由用户等进行指定。
步骤S103：创建与目标应用对应的初始网络安全策略。
实际应用中，在获取目标应用中各个组件的隔离策略之后，便可以创建与目标应用对应的初始网络安全策略(NetWorkPolicy)，用于对目标应用的各个组件进行隔离，比如完全隔离或者完全公开等。
步骤S104：基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略。
实际应用中，由于初始网络策略的入栈规则可以限制其他组件访问组件的访问信息，出栈规则可以限制组件访问其他组件的访问信息，匹配标签能够限制其他组件的身份信息，所以在创建与目标应用对应的初始网络安全策略之后，可以基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到与隔离策略相符合的目标网络安全策略。
步骤S105：将目标网络安全策略转换为与Kubernetes匹配的Iptables规则。
步骤S106：基于Iptables规则对目标应用进行隔离。
实际应用中，在得到目标网络安全策略之后，便可以将目标网络安全策略转换为与Kubernetes匹配的Iptables规则，并基于Iptables规则对目标应用进行隔离，以实现对Kubernetes中目标应用的应用隔离。其中，Iptables 规则是与最新的3.5版本Linux内核集成的IP信息包过滤系统，如果Linux系统连接到因特网或LAN、服务器或连接LAN(局域网)和因特网的代理服务器，则该系统有利于在Linux系统上更好地控制IP信息包过滤和防火墙配置。
本申请提供的一种应用隔离方法，确定出Kubernetes中待隔离的目标应用；获取目标应用中各个组件的隔离策略；创建与目标应用对应的初始网络安全策略；基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；将目标网络安全策略转换为与Kubernetes匹配的Iptables规则；基于Iptables规则对目标应用进行隔离。本申请中，可以根据组件的隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到与隔离策略相符的目标网络安全策略，并且之后将目标网络安全策略转换为与Kubernetes匹配的Iptables规则，从而可以基于Iptables规则对目标应用进行隔离，实现了对Kubernetes中应用的隔离。
本申请实施例提供的一种应用隔离方法，创建与目标应用对应的初始网络安全策略的步骤，可以具体为：创建初始网络安全策略；将初始网络安全策略的pod选择器(podSelecttor)字段设置为匹配表达式(matchExpression)的形式；将初始网络安全策略的operator值设为条件运算符In；将初始网络安全策略的匹配标签设置为目标应用中所有组件的标识的集合。应当指出，在将初始网络安全策略的匹配标签设置为目标应用中所有组件的标识的集合的过程中，标识间可以以逗号隔开，这样可以减少NetWorkPolicy的个数，从而避免了在宿主机上创建大量Iptables规则所导致的效率问题；此外，按照上述操作对初始网络安全策略进行设置后，当前应用便处于一种完全隔离的状态，即不允许任何流量进入应用内部，也不允许任何流量流出当前应用。
本申请实施例提供的一种应用隔离方法，基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签的步骤，可以具体为：基于隔离策略中的被访问策略修改入栈规则；基于隔离策略中的主动访问策略修 改出栈规则；将匹配标签的值设置为隔离策略中被隔离的组件的标识；其中，被访问策略表征其他组件访问目标应用的组件的策略；主动访问策略表征目标应用的组件访问其他组件的策略。也即可以在隔离策略中设置被访问策略、主动访问策略及被隔离的组件的标识，后续可以直接基于隔离策略中的被访问策略修改入栈规则，基于隔离策略中的主动访问策略修改出栈规则，将匹配标签的值设置为隔离策略中被隔离的组件的标识，从而快速完成对初始网络安全策略的修改。
实际应用中，基于隔离策略中的被访问策略修改入栈规则的过程，可以具体为：确定出与被访问策略对应的第一组件；将入栈规则中第一组件对应的端口号修改为被访问策略中的对应端口号；将入栈规则中第一组件对应的网络数据交换规则修改为被访问策略中的对应网络数据交换规则；将入栈规则中第一组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为被访问策略中对应的其他组件的标识。
实际应用中，基于隔离策略中的主动访问策略修改出栈规则的步骤，可以具体为：确定出与主动访问策略对应的第二组件；将出栈规则中第二组件对应的端口号修改为主动访问策略中的对应端口号；将出栈规则中第二组件对应的网络数据交换规则修改为主动访问策略中的对应网络数据交换规则；将出栈规则中第二组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为主动访问策略中对应的其他组件的标识。
本申请实施例提供的一种应用隔离方法，为了使得Kubernetes中的各个应用间可以通信，在确定出Kubernetes中待隔离的目标应用之前，还可以在Kubernetes中部署calico网络插件；将calico网络插件中的calico node设置为以demonest方式运行；将calico网络插件中的calicocontroller设置为以无状态负载方式运行。其中，calico是一个纯三层的协议，为Docker容器提供多主机间通信，它是一个纯三层的方法，使用虚拟路由代替虚拟交换，每一台虚拟路由通过BGP协议(边界网关协议)传播可达信息(路由)到剩余数据中心。
实际应用中，组件的标识可以包括组件的标签等。
请参阅图2，图2为本申请实施例提供的一种应用隔离系统的结构示意图。
本申请实施例提供的一种应用隔离系统，可以包括：
第一确定模块101，用于确定出Kubernetes中待隔离的目标应用；
第一获取模块102，用于获取目标应用中各个组件的隔离策略；
第一创建模块103，用于创建与目标应用对应的初始网络安全策略；
第一修改模块104，用于基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；
第一转换模块105，用于将目标网络安全策略转换为与Kubernetes匹配的Iptables规则；
第一隔离模块106，用于基于Iptables规则对目标应用进行隔离。
本申请实施例提供的一种应用隔离系统，第一创建模块可以包括：
第一创建单元，用于创建初始网络安全策略；
第一设置单元，用于将初始网络安全策略的pod选择器字段设置为匹配表达式的形式；
第二设置单元，用于将初始网络安全策略的operator值设为条件运算符In；
第三设置单元，用于将初始网络安全策略的匹配标签设置为目标应用中所有组件的标识的集合。
本申请实施例提供的一种应用隔离系统，第一修改模块可以包括：
第一修改子模块，用于基于隔离策略中的被访问策略修改入栈规则；
第二修改子模块，用于基于隔离策略中的主动访问策略修改出栈规则；
第一设置子模块，用于将匹配标签的值设置为隔离策略中被隔离的组件的标识；
其中，被访问策略表征其他组件访问目标应用的组件的策略；主动访问策略表征目标应用的组件访问其他组件的策略。
本申请实施例提供的一种应用隔离系统，第一修改子模块可以包括：
第一确定单元，用于确定出与被访问策略对应的第一组件；
第一修改单元，用于将入栈规则中第一组件对应的端口号修改为被访问策略中的对应端口号；
第二修改单元，用于将入栈规则中第一组件对应的网络数据交换规则修改为被访问策略中的对应网络数据交换规则；
第三修改单元，用于将入栈规则中第一组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为被访问策略中对应的其他组件的标识。
本申请实施例提供的一种应用隔离系统，第二修改子模块可以包括：
第二确定单元，用于确定出与主动访问策略对应的第二组件；
第四修改单元，用于将出栈规则中第二组件对应的端口号修改为主动访问策略中的对应端口号；
第五修改单元，用于将出栈规则中第二组件对应的网络数据交换规则修改为主动访问策略中的对应网络数据交换规则；
第六修改单元，用于将出栈规则中第二组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为主动访问策略中对应的其他组件的标识。
本申请实施例提供的一种应用隔离系统，还可以包括：
第一部署模块，用于第一确定模块确定出Kubernetes中待隔离的目标应用之前，在Kubernetes中部署calico网络插件；
第一设置模块，用于将calico网络插件中的calico node设置为以demonest方式运行；
第二设置模块，用于将calico网络插件中的calicocontroller设置为以无状态负载方式运行。
本申请实施例提供的一种应用隔离系统，组件的标识可以包括组件的标签。
本申请还提供了一种应用隔离设备及计算机可读存储介质，其均具有本申请实施例提供的一种应用隔离方法具有的对应效果。请参阅图3，图3为本申请实施例提供的一种应用隔离设备的结构示意图。
本申请实施例提供的一种应用隔离设备，包括存储器201和处理器202，存储器201中存储有计算机程序，处理器202执行计算机程序时实现如下步骤：
确定出Kubernetes中待隔离的目标应用；
获取目标应用中各个组件的隔离策略；
创建与目标应用对应的初始网络安全策略；
基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；
将目标网络安全策略转换为与Kubernetes匹配的Iptables规则；
基于Iptables规则对目标应用进行隔离。
本申请实施例提供的一种应用隔离设备，包括存储器201和处理器202，存储器201中存储有计算机程序，处理器202执行计算机程序时实现如下步骤：创建初始网络安全策略；将初始网络安全策略的pod选择器字段设置为匹配表达式的形式；将初始网络安全策略的operator值设为条件运算符In；将初始网络安全策略的匹配标签设置为目标应用中所有组件的标识的集合。
本申请实施例提供的一种应用隔离设备，包括存储器201和处理器202，存储器201中存储有计算机程序，处理器202执行计算机程序时实现如下步骤：基于隔离策略中的被访问策略修改入栈规则；基于隔离策略中的主动访问策略修改出栈规则；将匹配标签的值设置为隔离策略中被隔离的组件的标识；其中，被访问策略表征其他组件访问目标应用的组件的策略；主动访问策略表征目标应用的组件访问其他组件的策略。
本申请实施例提供的一种应用隔离设备，包括存储器201和处理器202，存储器201中存储有计算机程序，处理器202执行计算机程序时实现如下步骤：确定出与被访问策略对应的第一组件；将入栈规则中第一组件对应的端口号修改为被访问策略中的对应端口号；将入栈规则中第一组件对应的网络数据交换规则修改为被访问策略中的对应网络数据交换规则；将入栈规则中第一组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为被访问策略中对应的其他组件的标识。
本申请实施例提供的一种应用隔离设备，包括存储器201和处理器202，存储器201中存储有计算机程序，处理器202执行计算机程序时实现如下步骤：确定出与主动访问策略对应的第二组件；将出栈规则中第二组件对应的端口号修改为主动访问策略中的对应端口号；将出栈规则中第二组件对应的网络数据交换规则修改为主动访问策略中的对应网络数据交换规则；将出栈规则中第二组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为主动访问策略中对应的其他组件的标识。
本申请实施例提供的一种应用隔离设备，包括存储器201和处理器202，存储器201中存储有计算机程序，处理器202执行计算机程序时实现如下步骤：确定出Kubernetes中待隔离的目标应用之前，在Kubernetes中部署calico网络插件；将calico网络插件中的calico node设置为以demonest方式运行；将calico网络插件中的calicocontroller设置为以无状态负载方式运行。
本申请实施例提供的一种应用隔离设备，包括存储器201和处理器202，存储器201中存储有计算机程序，处理器202执行计算机程序时实现如下步骤：组件的标识包括组件的标签。
请参阅图4，本申请实施例提供的另一种应用隔离设备中还可以包括：与处理器202连接的输入端口203，用于传输外界输入的命令至处理器202；与处理器202连接的显示单元204，用于显示处理器202的处理结果至外界；与处理器202连接的通信模块205，用于实现应用隔离设备与外界的通信。显示单元204可以为显示面板、激光扫描使显示器等；通信模块205所采用的通信方式包括但不局限于移动高清链接技术(HML)、通用串行总线(USB)、高清多媒体接口(HDMI)、无线连接：无线保真技术(WiFi)、蓝牙通信技术、低功耗蓝牙通信技术、基于IEEE802.11s的通信技术。
本申请实施例提供的一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，计算机程序被处理器执行时实现如下步骤：
确定出Kubernetes中待隔离的目标应用；
获取目标应用中各个组件的隔离策略；
创建与目标应用对应的初始网络安全策略；
基于隔离策略修改初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；
将目标网络安全策略转换为与Kubernetes匹配的Iptables规则；
基于Iptables规则对目标应用进行隔离。
本申请实施例提供的一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，计算机程序被处理器执行时实现如下步骤：创建初始网络安全策略；将初始网络安全策略的pod选择器字段设置为匹配表达式的形式；将初始网络安全策略的operator值设为条件运算符In；将初始网络安全策略的匹配标签设置为目标应用中所有组件的标识的集合。
本申请实施例提供的一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，计算机程序被处理器执行时实现如下步骤：基于隔离策略中的被访问策略修改入栈规则；基于隔离策略中的主动访问策略修改出栈规则；将匹配标签的值设置为隔离策略中被隔离的组件的标识；其中，被访问策略表征其他组件访问目标应用的组件的策略；主动访问策略表征目标应用的组件访问其他组件的策略。
本申请实施例提供的一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，计算机程序被处理器执行时实现如下步骤：确定出与被访问策略对应的第一组件；将入栈规则中第一组件对应的端口号修改为被访问策略中的对应端口号；将入栈规则中第一组件对应的网络数据交换规则修改为被访问策略中的对应网络数据交换规则；将入栈规则中第一组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为被访问策略中对应的其他组件的标识。
本申请实施例提供的一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，计算机程序被处理器执行时实现如下步骤：确定出与主动访问策略对应的第二组件；将出栈规则中第二组件对应的端口号修改为主动访问策略中的对应端口号；将出栈规则中第二组件对应的网络数据交换规则修改为主动访问策略中的对应网络数据交换规则；将出栈规则中第二组件对应的pod选择器字段修改为matchlabel，将matchlabel的值设置为主动访问策略中对应的其他组件的标识。
本申请实施例提供的一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，计算机程序被处理器执行时实现如下步骤：确定出Kubernetes中待隔离的目标应用之前，在Kubernetes中部署calico网络插件；将calico网络插件中的calico node设置为以demonest方式运行；将calico网络插件中的calicocontroller设置为以无状态负载方式运行。
本申请实施例提供的一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，计算机程序被处理器执行时实现如下步骤：组件的标识包括组件的标签。
本申请所涉及的计算机可读存储介质包括随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质。
本申请实施例提供的应用隔离系统、设备及计算机可读存储介质中相关部分的说明请参见本申请实施例提供的应用隔离方法中对应部分的详细说明，在此不再赘述。另外，本申请实施例提供的上述技术方案中与现有技术中对应技术方案实现原理一致的部分并未详细说明，以免过多赘述。
还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
对所公开的实施例的上述说明，使本领域技术人员能够实现或使用本申请。对这些实施例的多种修改对本领域技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本申请的精神或范围的情况下，在其它实施例中实现。因此，本申请将不会被限制于本文所示的这些实施例， 而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。

Claims (10)

  1. 一种应用隔离方法，其特征在于，包括：
    确定出Kubernetes中待隔离的目标应用；
    获取所述目标应用中各个组件的隔离策略；
    创建与所述目标应用对应的初始网络安全策略；
    基于所述隔离策略修改所述初始网络安全策略的入栈规则、出栈规则和匹配标签，得到目标网络安全策略；
    将所述目标网络安全策略转换为与所述Kubernetes匹配的Iptables规则；
    基于所述Iptables规则对所述目标应用进行隔离。
  2. 根据权利要求1所述的方法，其特征在于，所述创建与所述目标应用对应的初始网络安全策略，包括：
    创建所述初始网络安全策略；
    将所述初始网络安全策略的pod选择器字段设置为匹配表达式的形式；
    将所述初始网络安全策略的operator值设为条件运算符In；
    将所述初始网络安全策略的所述匹配标签设置为所述目标应用中所有组件的标识的集合。
  3. 根据权利要求2所述的方法，其特征在于，所述基于所述隔离策略修改所述初始网络安全策略的入栈规则、出栈规则和匹配标签，包括：
    基于所述隔离策略中的被访问策略修改所述入栈规则；
    基于所述隔离策略中的主动访问策略修改所述出栈规则；
    将所述匹配标签的值设置为所述隔离策略中被隔离的组件的标识；
    其中，所述被访问策略表征其他组件访问所述目标应用的组件的策略；所述主动访问策略表征所述目标应用的组件访问其他组件的策略。
  4. 根据权利要求3所述的方法，其特征在于，所述基于所述隔离策略中的被访问策略修改所述入栈规则，包括：
    确定出与所述被访问策略对应的第一组件；
    将所述入栈规则中所述第一组件对应的端口号修改为所述被访问策略 中的对应端口号；
    将所述入栈规则中所述第一组件对应的网络数据交换规则修改为所述被访问策略中的对应网络数据交换规则；
    将所述入栈规则中所述第一组件对应的pod选择器字段修改为matchlabel，将所述matchlabel的值设置为所述被访问策略中对应的其他组件的标识。
  5. 根据权利要求4所述的方法，其特征在于，所述基于所述隔离策略中的主动访问策略修改所述出栈规则，包括：
    确定出与所述主动访问策略对应的第二组件；
    将所述出栈规则中所述第二组件对应的端口号修改为所述主动访问策略中的对应端口号；
    将所述出栈规则中所述第二组件对应的网络数据交换规则修改为所述主动访问策略中的对应网络数据交换规则；
    将所述出栈规则中所述第二组件对应的pod选择器字段修改为matchlabel，将所述matchlabel的值设置为所述主动访问策略中对应的其他组件的标识。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述确定出Kubernetes中待隔离的目标应用之前，还包括：
    在所述Kubernetes中部署calico网络插件；
    将所述calico网络插件中的calico node设置为以demonest方式运行；
    将所述calico网络插件中的calicocontroller设置为以无状态负载方式运行。
  7. 根据权利要求6所述的方法，其特征在于，所述组件的标识包括所述组件的标签。
  8. 一种应用隔离系统，其特征在于，包括：
    第一确定模块，用于确定出Kubernetes中待隔离的目标应用；
    第一获取模块，用于获取所述目标应用中各个组件的隔离策略；
    第一创建模块，用于创建与所述目标应用对应的初始网络安全策略；
    第一修改模块，用于基于所述隔离策略修改所述初始网络安全策略的 入栈规则、出栈规则和匹配标签，得到目标网络安全策略；
    第一转换模块，用于将所述目标网络安全策略转换为与所述Kubernetes匹配的Iptables规则；
    第一隔离模块，用于基于所述Iptables规则对所述目标应用进行隔离。
  9. 一种应用隔离设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述计算机程序时实现如权利要求1至7任一项所述应用隔离方法的步骤。
  10. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1至7任一项所述应用隔离方法的步骤。
PCT/CN2021/073438 2020-05-27 2021-01-23 一种应用隔离方法、系统、设备及计算机可读存储介质 WO2021238256A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/928,113 US20230208881A1 (en) 2020-05-27 2021-01-23 Application isolation method, system and device, and computer-readable storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010461867.2 2020-05-27
CN202010461867.2A CN111709014B (zh) 2020-05-27 2020-05-27 一种应用隔离方法、系统、设备及计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2021238256A1 true WO2021238256A1 (zh) 2021-12-02

Family

ID=72538752

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/073438 WO2021238256A1 (zh) 2020-05-27 2021-01-23 一种应用隔离方法、系统、设备及计算机可读存储介质

Country Status (3)

Country Link
US (1) US20230208881A1 (zh)
CN (1) CN111709014B (zh)
WO (1) WO2021238256A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338405A (zh) * 2021-12-31 2022-04-12 中电福富信息科技有限公司 一种基于Kubernetes实现云平台租户级网络策略配置的方法及其系统

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111709014B (zh) * 2020-05-27 2022-06-07 浪潮电子信息产业股份有限公司 一种应用隔离方法、系统、设备及计算机可读存储介质
CN113676524A (zh) * 2021-08-09 2021-11-19 浪潮云信息技术股份公司 一种实现多cpu架构容器网络代理的方法
CN114070637B (zh) * 2021-11-23 2024-01-23 北京天融信网络安全技术有限公司 基于属性标签的访问控制方法、系统、电子设备及存储介质
CN115801569B (zh) * 2023-02-07 2023-04-25 苏州浪潮智能科技有限公司 一种访问规则部署方法、装置、设备、介质及云平台

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090235324A1 (en) * 2008-03-17 2009-09-17 International Business Machines Corporation Method for discovering a security policy
CN109561108A (zh) * 2019-01-07 2019-04-02 中国人民解放军国防科技大学 一种基于策略的容器网络资源隔离控制方法
CN110266679A (zh) * 2019-06-14 2019-09-20 腾讯科技(成都)有限公司 容器网络隔离方法及装置
US20190377591A1 (en) * 2018-06-11 2019-12-12 Vmware, Inc. Cloud agnostic blueprint
CN111049796A (zh) * 2019-10-25 2020-04-21 中国通信服务股份有限公司 一种基于Open vSwitch实现Overlay多租户CNI容器网络的方法
CN111709014A (zh) * 2020-05-27 2020-09-25 浪潮电子信息产业股份有限公司 一种应用隔离方法、系统、设备及计算机可读存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9571524B2 (en) * 2015-01-20 2017-02-14 Cisco Technology, Inc. Creation of security policy templates and security policies based on the templates
CN106656980A (zh) * 2016-10-21 2017-05-10 郑州云海信息技术有限公司 一种自动化配置Docker容器访问控制的方法
US10944793B2 (en) * 2017-06-29 2021-03-09 Juniper Networks, Inc. Rules-based network security policy modification
CN107864131A (zh) * 2017-11-03 2018-03-30 郑州云海信息技术有限公司 一种实现Kubernetes集群多租户网络隔离的方法及系统
CN109992956A (zh) * 2017-12-29 2019-07-09 华为技术有限公司 容器的安全策略的处理方法和相关装置
CN108540453B (zh) * 2018-03-15 2021-06-18 新智数字科技有限公司 一种应用于PaaS的网络隔离方法、装置以及设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090235324A1 (en) * 2008-03-17 2009-09-17 International Business Machines Corporation Method for discovering a security policy
US20190377591A1 (en) * 2018-06-11 2019-12-12 Vmware, Inc. Cloud agnostic blueprint
CN109561108A (zh) * 2019-01-07 2019-04-02 中国人民解放军国防科技大学 一种基于策略的容器网络资源隔离控制方法
CN110266679A (zh) * 2019-06-14 2019-09-20 腾讯科技(成都)有限公司 容器网络隔离方法及装置
CN111049796A (zh) * 2019-10-25 2020-04-21 中国通信服务股份有限公司 一种基于Open vSwitch实现Overlay多租户CNI容器网络的方法
CN111709014A (zh) * 2020-05-27 2020-09-25 浪潮电子信息产业股份有限公司 一种应用隔离方法、系统、设备及计算机可读存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338405A (zh) * 2021-12-31 2022-04-12 中电福富信息科技有限公司 一种基于Kubernetes实现云平台租户级网络策略配置的方法及其系统

Also Published As

Publication number Publication date
CN111709014A (zh) 2020-09-25
US20230208881A1 (en) 2023-06-29
CN111709014B (zh) 2022-06-07

Similar Documents

Publication Publication Date Title
WO2021238256A1 (zh) 一种应用隔离方法、系统、设备及计算机可读存储介质
US11888899B2 (en) Flow-based forwarding element configuration
WO2018028606A1 (zh) 转发策略配置
US9515890B2 (en) Method, system and controlling bridge for obtaining port extension topology information
EP2206052B1 (en) Methods and apparatus for managing addresses related to virtual partitions of a session exchange device
CN109937400A (zh) 用于虚拟机的实时迁移的流状态传送
US7869382B2 (en) Network management assisted discovery
JP7413415B2 (ja) ハイブリッドクラウド環境における通信方法、ゲートウェイ、並びに管理方法及び装置
JP2012533253A (ja) 少なくとも１つの仮想ネットワークをオンザフライかつオンデマンドでデプロイする方法及びシステム
CN113872845B (zh) 建立vxlan隧道的方法及相关设备
CN111010340B (zh) 数据报文转发控制方法、装置及计算装置
WO2017107871A1 (zh) 访问控制方法和网络设备
US10862850B2 (en) Network-address-to-identifier translation in virtualized computing environments
CN112351034A (zh) 防火墙设置方法、装置、设备及存储介质
CN105657078A (zh) 一种数据传输方法、装置及多层网络管理器
WO2021135493A1 (zh) 一种家庭网关访问方法、装置、系统处理器及存储介质
CN108494679B (zh) 一种基于Linux系统实现路由器的SSH报文转发方法和装置
CN108881027B (zh) 一种基于Linux系统实现路由器的radius报文转发方法和装置
CN108512737B (zh) 一种数据中心ip层互联的方法和sdn控制器
JP2007180963A (ja) クラスタノード制御プログラム、クラスタノード、クラスタシステム制御方法
CN116248595B (zh) 一种云内网与物理网通信的方法、装置、设备以及介质
WO2024001017A1 (zh) 一种防火墙设置方法、系统、设备及非易失性可读存储介质
CN115987778B (zh) 一种基于Kubernetes集群的容器通信方法
WO2016173196A1 (zh) 地址映射关系的学习方法及装置
CN116264518A (zh) 基于云专线的云服务互访方法、系统、网络节点和介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21812154

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21812154

Country of ref document: EP

Kind code of ref document: A1