CN114091025B - Security detection method, security detection device and mirror image construction method based on cloud native platform - Google Patents

Abstract

The invention discloses a cloud native platform-based safety detection method, a cloud native platform-based safety detection device and a cloud native platform-based mirror image construction method, and relates to the technical field of communication. The method comprises the following steps: executing a first security detection process for each mirror layer included in the pre-built target mirror; under the condition that each mirror image layer of the target mirror image passes through the first security detection process, running a container corresponding to the target mirror image; a second security detection process is performed on the container in response to the container configuration change reminder information for the container. The method can realize automatic safety detection of the mirror image and the container.

Description

Security detection method, device, and image building method based on cloud native platform

Technical Field

The present invention relates to the field of communication technology, and in particular to a security detection method, a detection device, an image building method and a cloud native platform based on a cloud native platform.

Background technique

Cloud-native technology helps organizations build and run elastically scalable applications in new dynamic environments such as public clouds, private clouds, and hybrid clouds. The current cloud-native service platform improves application development efficiency by introducing container technology.

After the cloud-native service platform introduces container technology, in addition to facing security issues in traditional cloud environments, it also needs to consider container-related security issues. If there is a problem with the security configuration of the container or image, such as not setting Security-Enhanced Linux (SELinux) or not setting it to run in root/privileged mode, the cloud-native service platform will be easily attacked, which will cause the cloud-native service platform to be unable to use normally.

There is an urgent need for a security detection method to address the problem of improper security configuration of containers or images in cloud native platforms.

Summary of the invention

To this end, the present invention provides a security detection method, a detection device, an image building method and a cloud native platform based on a cloud native platform to solve the problem of improper security configuration of containers or images of cloud native platforms in the prior art.

In order to achieve the above-mentioned object, the first aspect of the present invention provides a security detection method based on a cloud native platform. The cloud native platform includes at least one container, each of which corresponds to a pre-built target image, and the target image includes at least one image layer. The security detection method includes:

For each image layer included in the pre-built target image, a first security detection process is performed;

When each image layer of the target image passes the first security detection process, running a container corresponding to the target image;

In response to the container configuration change reminder information for the container, a second security detection process is performed on the container.

Optionally, the performing of the first security detection process includes:

Start the current mirror layer;

Perform security checks on the current image layer based on the preset image compliance detection strategy.

Optionally, the step of performing security detection on the current image layer based on a preset image compliance detection strategy includes:

Based on the preset image compliance detection strategy, security detection is performed on one or more of the image source, image version, and image file content corresponding to the current image layer.

Optionally, after performing the first security detection process for each image layer included in the pre-built target image, the method further includes:

If the current image layer fails the first security detection process, image security hardening is performed on the current image layer based on a preset image compliance hardening strategy;

The first security detection process is re-executed on the current image layer after the image security hardening process.

Optionally, before performing a second security detection process on the container in response to the container configuration change reminder information for the container, the method further includes:

Collecting container configuration information corresponding to the container;

If the container configuration information has not changed, returning to the step of collecting the container configuration information corresponding to the container;

When the container configuration information is changed, container configuration change reminder information for the container is generated.

Optionally, performing a second safety detection process on the container includes:

Based on a preset container compliance detection strategy, security detection is performed on one or more of the software information, operating system information, and configuration information corresponding to the container.

Optionally, after performing a second security detection process on the container in response to the container configuration change reminder information for the container, the method further includes:

If the container fails the second security detection process, performing container security hardening processing on the container based on a preset container compliance hardening strategy;

The second safety detection process is re-executed on the container after the container safety reinforcement process.

A second aspect of the present invention provides a security detection device based on a cloud native platform, the cloud native platform includes at least one container, each of the containers corresponds to a pre-built target image, and the target image includes at least one image layer; the security detection device includes:

A first security detection module, used for performing a first security detection process for each image layer included in the pre-built target image;

A control module, configured to run a container corresponding to the target image when each image layer of the target image passes the first security detection process;

The second security detection module is used to perform a second security detection process on the container in response to the container configuration change reminder information for the container.

A third aspect of the present invention provides a mirror image construction method, the mirror image construction method comprising:

Pull the base image as the first image layer of the target image;

Building a security processing layer on top of the first image layer, wherein the security processing layer is used to implement the security detection method as described in any one of the above;

At least one other image layer is constructed based on the base image.

A fourth aspect of the present invention provides a cloud native platform, the cloud native platform comprising:

At least one container, each of the containers corresponds to a target image constructed according to the above-mentioned image construction method, and the target image includes at least one image layer.

The present invention has the following advantages:

The present invention provides a security detection method, detection device, image building method and cloud native platform based on a cloud native platform. The cloud native platform includes at least one container, each container corresponds to a pre-built target image, and the target image includes multiple image layers. The security detection method includes: first, for each image layer included in the pre-built target image, a first security detection process is performed; then, when each image layer of the target image passes the first security detection process, the container corresponding to the target image is run; finally, in response to the container configuration change reminder information for the container, a second security detection process is performed on the container, which can realize automatic security detection of the image and the container, ensure that the security risks existing in the image and the container can be discovered in time, and then improve the security performance of the cloud native platform.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present invention, but do not constitute a limitation of the present invention.

FIG1 is a flow chart of a security detection method based on a cloud native platform provided by an embodiment of the present invention;

FIG2 is a flow chart of a first security detection process provided by an embodiment of the present invention;

FIG3 is a flow chart of another cloud-native platform-based security detection method provided by an embodiment of the present invention;

FIG4 is a schematic diagram of the structure of a security detection device based on a cloud native platform provided by an embodiment of the present invention;

FIG5 is a flow chart of a mirror image construction method provided by an embodiment of the present invention;

FIG6 is a schematic diagram of the structure of a target image provided by an embodiment of the present invention.

Detailed ways

The specific implementation of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present invention, and is not used to limit the present invention.

As used herein, the term "and/or" includes any and all combinations of one or more of the associated listed items.

The terms used in the present invention are only used to describe specific embodiments and are not intended to limit the present invention. As used in the present invention, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

When the terms “comprising” and/or “made of…” are used in the present invention, it specifies the existence of the stated features, integers, steps, operations, elements and/or components, but does not exclude the existence or addition of one or more other features, integers, steps, operations, elements, components and/or groups thereof.

The embodiments of the present invention may be described with reference to plan views and/or cross-sectional views by way of ideal schematic views of the present invention. Therefore, the exemplary illustrations may be modified according to manufacturing techniques and/or tolerances.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present invention have the same meaning as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present invention, and will not be interpreted as having an idealized or overly formal meaning unless the present invention clearly defines it as such.

FIG1 is a flow chart of a cloud-native platform-based security detection method provided by an embodiment of the present invention, which is applied to a security detection device.

The cloud native platform refers to a platform for building and running elastically scalable applications in new dynamic environments such as public clouds, private clouds, and hybrid clouds. The cloud native platform includes at least one container, each of which corresponds to a pre-built target image, which includes multiple image layers. The container is a collection of processes with view isolation, limited resources, and an independent file system.

As shown in FIG. 1 , the safety detection method includes the following steps S101 to S103 .

Step S101: Perform a first security detection process for each image layer included in the pre-built target image.

The target image is a special file system that provides information such as programs, libraries, resources, configuration parameters, etc. required to run the container. The target image includes multiple image layers, each of which has a unique image identifier. The first security detection process is a detection process for performing security detection on the image layer.

In this embodiment, by performing the first security detection process on the image layer, the security of the image layer can be automatically confirmed, avoiding the failure to timely discover security risks caused by improper configuration of the image layer, and improving the security performance of the cloud native platform where the target image is located.

Step S102: When each image layer of the target image passes the first security detection process, run a container corresponding to the target image.

The container corresponding to the target image is the entity on which the target image runs, that is, a container storage layer is added on top of the target image to form the container corresponding to the target image. The container storage layer is used for read and write operations when the container is running.

In one embodiment, after running the container corresponding to the target image, container configuration information corresponding to the container is collected.

The container configuration information includes one or more of the software information, operating system information, and configuration information corresponding to the container. The software information corresponding to the container is the information of the software installed in the container, such as the software version, software source, and software installation data. The operating system information corresponding to the container refers to the information of the operating system environment running the container, such as the operating system version information, operating system memory usage information, etc. The configuration information corresponding to the container includes anonymous volumes, environment variables, and other information.

In one embodiment, in order to save container resources, the step of collecting container configuration information corresponding to the container includes: collecting container configuration information corresponding to the container based on a preset period. The preset period can be set according to specific scenarios, for example, 12 hours, one day or one week.

In one embodiment, after collecting the container configuration information corresponding to the container, it is determined whether the container configuration information is changed compared to the container configuration information collected last time.

In some embodiments, when the container configuration information has not changed, the process returns to the step of collecting the container configuration information corresponding to the container, and re-determines whether the collected container configuration information has changed compared to the last collected container configuration information.

In other embodiments, when container configuration information is changed, container configuration change reminder information for the container is generated.

Step S103: In response to the container configuration change reminder information for the container, a second security detection process is performed on the container.

The second safety detection process is a detection process for performing safety detection on the container.

In one embodiment, in response to container configuration change reminder information for the container, a second security detection process is performed on the container, including: performing a security detection on one or more of the software information, operating system and configuration information corresponding to the container based on a preset container compliance detection strategy.

Among them, the container compliance detection strategy is a strategy used to perform security compliance detection on containers.

In another embodiment, in response to the container configuration change reminder information for the container, a second security check process is performed on the container, including: performing security checks on one or more of docker (an application container engine) or KBS (full name kubernetes, a container orchestration engine) based on a preset container compliance check strategy.

In this embodiment, by performing a second security detection process on the container, the security of the container can be automatically confirmed, avoiding the failure to timely discover security risks caused by improper container configuration, thereby improving the security performance of the cloud native platform where the container is located.

In one embodiment, after executing a second security check process on the container in response to a container configuration change reminder message for the container, if the container fails the second security check process, the container is security hardened based on a preset container compliance hardening strategy, and the second security check process is re-executed on the container after the container security hardening process.

In particular, the container compliance hardening strategy is a strategy used to harden the security compliance of containers.

In one embodiment, the step of performing container security hardening processing on the container based on a preset container compliance hardening strategy includes: performing security detection on one or more of the software information, operating system, and configuration information corresponding to the container based on a preset container compliance detection strategy.

In another embodiment, the step of performing container security hardening processing on the container based on a preset container compliance hardening strategy includes: hardening one or more of docker or KBS based on a preset container compliance hardening strategy.

In some embodiments, after re-execution of the second security inspection process on the container that has undergone container security reinforcement processing, if the container that has undergone container security reinforcement processing still fails the second security inspection process, container security reinforcement processing is performed again on the container based on a preset container compliance reinforcement strategy, and the second security inspection process is re-executed on the container that has undergone container security reinforcement processing until the container passes the second security inspection process.

In this embodiment, the container is security hardened based on the preset container compliance hardening strategy, which can realize the self-healing of the container when there is a security problem and improve the security of the container. Re-performing the second security detection process on the container after the container security hardening process can further confirm the security of the container and avoid the problem of improper container configuration.

An embodiment of the present invention provides a security detection method based on a cloud native platform, the cloud native platform includes at least one container, each container corresponds to a pre-built target image, the target image includes multiple image layers, and the security detection method includes: first, for each image layer included in the pre-built target image, a first security detection process is performed; then, when each image layer of the target image passes the first security detection process, a container corresponding to the target image is run; finally, in response to container configuration change reminder information for the container, a second security detection process is performed on the container, so that automatic security detection of images and containers can be realized, ensuring that security risks existing in images and containers can be discovered in time, thereby improving the security performance of the cloud native platform.

Fig. 2 is a flow chart of the first security detection process provided by an embodiment of the present invention. In one embodiment, as shown in Fig. 2, for each image layer included in the pre-built target image, executing the first security detection process includes: step S201-step S202.

Step S201, start the current mirror layer.

The current image layer is the image layer that needs to be security checked.

In the embodiment of the present invention, the target image has multiple image layers that are started in layers. The step of starting the current image layer includes: starting the current image layer based on a preset start command, wherein the preset start command can be used to configure the start order of each image layer in the target image's multiple image layers.

Step S202: Perform security detection on the current image layer based on a preset image compliance detection strategy.

The image compliance detection policy is a policy used to perform security compliance detection on the image layer.

In one implementation, a security check is performed on at least one check item corresponding to the current image layer based on a preset image compliance check policy.

The check items include: one or more of the image source, image version and image file content. The check items may also include other items, which may be set according to the specific scenario in the actual application scenario.

It should be noted that, if at least one check item corresponding to the current image layer fails the security check, the current image layer fails the first security check process; if all check items corresponding to the current image layer pass the security check, the current image layer passes the first security check process.

In one embodiment, the step of performing security detection on the current image layer based on a preset image compliance detection strategy includes: performing security detection on one or more of the image source, image version, and image file content corresponding to the current image layer based on the preset image compliance detection strategy.

Among them, the image source is security-checked based on the preset image compliance detection strategy, which can detect whether the image source of the current image layer is a legitimate source. For example, for the first image layer of the target image, it is detected whether the source of the base image corresponding to the first layer is the preset official source.

Based on the preset image compliance detection strategy, the image version is security-checked to detect whether the image version of the current image layer is the latest version. For example, for the first image layer of the target image, detect whether the version of the base image corresponding to the first layer is the latest version. It should be noted that the latest version of the image generally fixes known vulnerabilities compared to the previous version of the image, and has high security.

Based on the preset image compliance detection strategy, the image file content is security checked to detect whether there are loopholes in the image file content of the current image layer to eliminate security risks.

Figure 3 is a flow chart of another cloud-native platform-based security detection method provided by an embodiment of the present invention. In one embodiment, after executing the first security detection process for each image layer included in the pre-built target image, as shown in Figure 3, the method further includes: step S301-step S302.

Step S301: When the current image layer fails the first security detection process, image security hardening is performed on the current image layer based on a preset image compliance hardening strategy.

Among them, the image compliance hardening strategy is a strategy used to harden the security compliance of the image layer.

In this embodiment, the image security reinforcement processing is performed on the current image layer based on the preset image compliance reinforcement strategy, which can realize the self-healing ability of the image layer when security problems occur, improve the security of the current image layer, and avoid the problem of improper configuration of the image layer.

In one embodiment, in order to improve the security of the target image, each image layer in the target image can be pre-processed for image security based on a preset image compliance hardening strategy, and then the above-mentioned step of executing the first security detection process (step S101) is executed for each image layer included in the pre-built target image.

In one embodiment, the step of performing image security hardening processing on the current image layer based on a preset image compliance hardening policy includes:

Based on the preset image compliance hardening strategy, corresponding security hardening is performed on the verification items in the current image layer that have not passed the security check during the first security check process.

For example, in the first security check process, if the verification item that does not pass the security check in the current image layer is the image version, the image version of the current image layer is replaced with a preset version, and the preset version may be the latest version.

Step S302: re-execute the first security detection process on the current image layer after the image security hardening process.

The first security detection process is re-executed on the current image layer after the image security reinforcement process, so as to further confirm the security of the current image layer.

In one embodiment, after re-executing the first security detection process for the current image layer after the image security hardening process, if the current image layer after the image security hardening process still fails to pass the first security detection process, step S301-step S302 is re-executed on the current image layer until the current image layer after the image security hardening process passes the first security detection process.

In another embodiment, after re-executing the first security detection process for the current image layer after the image security hardening process, if the current image layer after the image security hardening process passes the first security detection process, the first security detection process is performed on the next current image layer.

FIG4 is a schematic diagram of the structure of a security detection device based on a cloud native platform provided by an embodiment of the present invention. The cloud native platform includes at least one container, each container corresponds to a pre-built target image, and the target image includes multiple image layers. As shown in FIG4 , the security detection device includes: a first security detection module 41, a control module 42, and a second security detection module 43.

The first security detection module 41 is used to perform a first security detection process for each image layer included in the pre-built target image.

In this embodiment, the first security detection module 41 can automatically confirm the security of the image layer by performing the first security detection process on the image layer, avoid the failure to timely discover security risks caused by improper configuration of the image layer, and improve the security performance of the cloud native platform where the target image is located.

In one embodiment, the first security detection module 41 is used to start the current image layer and perform security detection on the current image layer based on a preset image compliance detection policy.

In one embodiment, the security detection device further includes a first security reinforcement module, which is used to perform image security reinforcement processing on the current image layer based on a preset image compliance reinforcement strategy when the current image layer fails the first security detection process.

In one embodiment, the first security detection module 41 is further configured to re-execute the first security detection process on the current image layer after the image security hardening process.

The control module 42 is used to run a container corresponding to the target image when each image layer of the target image passes the first security detection process.

In one embodiment, the safety detection device further includes a collection module and a collection information processing module.

The collection module is used to collect container configuration information corresponding to the container.

The collected information processing module is used to determine whether the container configuration information has changed compared to the container configuration information collected last time. If the container configuration information has not changed, the collection module returns to the step of collecting the container configuration information corresponding to the container; if the container configuration information has changed, a container configuration change reminder information for the container is generated.

The second security detection module 43 is configured to execute a second security detection process on the container in response to the container configuration change reminder information for the container.

The second safety detection process is a detection process for performing safety detection on the container.

In one embodiment, the second security detection module 43 is used to perform security detection on one or more of the software information, operating system and configuration information corresponding to the container based on a preset container compliance detection policy.

In one embodiment, the security detection device further includes a second security reinforcement module, which is used to perform container security reinforcement processing on the container based on a preset container compliance reinforcement strategy when the container fails the second security detection process.

The second safety detection module 43 is used to re-execute the second safety detection process on the container after the container safety reinforcement process.

In this embodiment, the second security reinforcement module performs container security reinforcement processing on the container based on the preset container compliance reinforcement strategy, which can realize the self-healing of the container when there is a security problem and improve the security of the container. The second security detection module 43 re-executes the second security detection process on the container after the container security reinforcement processing, which can further confirm the security of the container and avoid the problem of improper container configuration.

The step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

An embodiment of the present invention provides a security detection device based on a cloud native platform, the cloud native platform includes at least one container, each container corresponds to a pre-built target image, the target image includes multiple image layers, and the security detection device includes: a first security detection module, used to execute a first security detection process for each image layer included in the pre-built target image; a control module, used to run a container corresponding to the target image when each image layer of the target image passes the first security detection process; a second security detection module, used to execute a second security detection process for the container in response to container configuration change reminder information for the container, which can realize automatic security detection of images and containers, ensure that security risks existing in images and containers can be discovered in time, and thus improve the security performance of the cloud native platform.

Fig. 5 is a flow chart of an image building method provided by an embodiment of the present invention, which is applied to a cloud native platform. As shown in Fig. 5, the image building method includes: step S501-step S502.

Step S501: Pull a base image as the first image layer of a target image.

The base image is an image pulled from a public image library, such as Community ENTerprise Operating System (CentOS), Ubuntu (a Linux operating system mainly based on desktop applications), etc. The base image can be used as the first image layer of the target image.

Step S502: construct a security processing layer on top of the first image layer.

The security processing layer is used to implement the security detection method provided in the aforementioned embodiment of the present invention.

Step S503: construct at least one other image layer based on the base image.

In one embodiment, the step of building at least one other image layer based on the base image includes: installing preset software on the base image to obtain another image layer. The preset software can be set according to the specific scenario and is not limited in this embodiment.

In one embodiment, the at least one other image layer may be located above the security processing layer.

In some implementation scenarios, when the target image includes only one image layer, only the above steps S501 and S502 may be performed to construct the target image.

In other implementation scenarios, when the target image only includes multiple image layers, the above steps S501 to S503 may be performed to construct the target image.

An image building method provided by an embodiment of the present invention can realize automatic security detection of a target image and a container corresponding to the target image after the target image is built by adding a security processing layer in the target image building process, thereby ensuring that the potential safety hazards existing in the target image and the container corresponding to the target image can be discovered in time, and can also realize self-healing of the image or container when there are security problems, thereby improving the security performance of the cloud native platform.

FIG6 is a schematic diagram of the structure of a target image provided by an embodiment of the present invention.

In an implementation scenario, the security processing layer of the target image can be composed of multiple functional layers integrating different functions. As shown in FIG6 , the target image includes a base image layer 61 , and the base image layer includes a security processing layer, and the security processing layer includes a security compliance verification layer 62 and a security compliance reinforcement layer 63 .

The security compliance verification layer 62 is configured with an image compliance detection strategy, an image compliance detection script, a container compliance detection strategy, and a container compliance detection script. The security compliance verification layer 62 can implement the corresponding image compliance detection strategy by executing the image compliance detection script, and implement the corresponding container compliance detection strategy by executing the container compliance detection script.

The security compliance verification layer 62 is used to perform a first security detection process on each image layer included in the target image; and, in response to the container configuration change reminder information, perform a second security detection process on the container corresponding to the target image.

The security compliance reinforcement layer 63 is configured with an image compliance reinforcement policy, an image compliance reinforcement script, a container compliance reinforcement policy, and a container compliance reinforcement script. The security compliance reinforcement layer 63 can implement the corresponding image compliance reinforcement policy by executing the image compliance reinforcement script, and implement the corresponding container compliance reinforcement policy by executing the container compliance reinforcement script.

The security compliance reinforcement layer 63 is used to perform image security reinforcement processing on the current image layer based on a preset image compliance reinforcement strategy when the current image layer fails to pass the first security detection process; it is also used to perform container security reinforcement processing on the container based on a preset container compliance reinforcement strategy when the container corresponding to the target image fails to pass the second security detection process.

In one embodiment, after the target image is built, the cloud native platform can also build a corresponding container based on the target image. The container corresponding to the target image is the entity running the target image, that is, a container storage layer is added on top of the target image to form the container corresponding to the target image. The container storage layer is used for read and write operations when the container is running.

The target image provided by the embodiment of the present invention can realize automatic security detection of the target image and the container corresponding to the target image, ensuring that the potential security risks existing in the target image and the container corresponding to the target image can be discovered in time, thereby improving the security performance of the cloud native platform.

An embodiment of the present invention also provides a cloud native platform, which includes: at least one container, each container corresponds to a target image pre-built according to the image building method provided by the aforementioned embodiment of the present invention, and the target image includes at least one image layer.

In one embodiment, the cloud native platform further includes: a construction module, which is used to build a target image according to the image construction method provided by the aforementioned embodiment of the present invention, and to build a container corresponding to the target image.

It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules/units in the invented method described above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

Those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present embodiment and to form different embodiments.

It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims (9)

1. A security detection method based on a cloud native platform, characterized in that the cloud native platform includes at least one container, each of the containers corresponds to a pre-built target image, the target image includes at least one image layer, and the security detection method includes: For each image layer included in the pre-built target image, a first security detection process is performed; When each image layer of the target image passes the first security detection process, running a container corresponding to the target image; Collecting container configuration information corresponding to the container; If the container configuration information has not changed, returning to the step of collecting the container configuration information corresponding to the container; When the container configuration information is changed, generating container configuration change reminder information for the container; In response to the container configuration change reminder information for the container, a second security detection process is performed on the container. 2. The security detection method according to claim 1, wherein the performing of the first security detection process comprises: Start the current layer image layer; Perform security checks on the current image layer based on the preset image compliance detection strategy. 3. The security detection method according to claim 2, characterized in that the step of performing security detection on the current image layer based on a preset image compliance detection strategy comprises: Based on the preset image compliance detection strategy, security detection is performed on one or more of the image source, image version, and image file content corresponding to the current image layer. 4. The security detection method according to claim 1, characterized in that after performing the first security detection process for each image layer included in the pre-built target image, the method further comprises: If the current image layer fails the first security detection process, image security hardening is performed on the current image layer based on a preset image compliance hardening strategy; The first security detection process is re-executed on the current image layer after the image security hardening process. 5. The safety detection method according to claim 1, characterized in that performing a second safety detection process on the container comprises: Based on a preset container compliance detection strategy, security detection is performed on one or more of the software information, operating system information, and configuration information corresponding to the container. 6. The security detection method according to claim 1, characterized in that after performing a second security detection process on the container in response to the container configuration change reminder information for the container, the method further comprises: If the container fails the second security detection process, performing container security hardening processing on the container based on a preset container compliance hardening strategy; The second safety detection process is re-executed on the container after the container safety reinforcement process. 7. A security detection device based on a cloud native platform, characterized in that the cloud native platform includes at least one container, each of the containers corresponds to a pre-built target image, and the target image includes at least one image layer; the security detection device includes: A first security detection module, used for performing a first security detection process for each image layer included in the pre-built target image; A control module, configured to run a container corresponding to the target image when each image layer of the target image passes the first security detection process; A second security detection module, configured to perform a second security detection process on the container in response to the container configuration change reminder information for the container; Before the second security detection module performs a second security detection process on the container in response to the container configuration change reminder information for the container, the security detection device is further used to: Collecting container configuration information corresponding to the container; If the container configuration information has not changed, returning to the step of collecting the container configuration information corresponding to the container; When the container configuration information is changed, container configuration change reminder information for the container is generated. 8. A mirror image construction method, characterized in that the mirror image construction method comprises: Pull the base image as the first image layer of the target image; Building a security processing layer on top of the first image layer, wherein the security processing layer is used to implement the security detection method according to any one of claims 1 to 6; At least one other image layer is constructed based on the base image. 9. A cloud native platform, characterized in that the cloud native platform includes: At least one container, each of the containers corresponds to a target image constructed according to the image construction method according to claim 8, and the target image includes at least one image layer.