CN118862163A - Container cluster log security protection method, device and storage medium - Google Patents

Abstract

The present invention discloses a container cluster log security protection method, device and storage medium, wherein the protection method comprises: a first server collects logs of a container cluster through a collection program; the first server sends the collected logs to a second server; the second server cuts the received logs; the second server detects sensitive information on the cut logs, and desensitizes the cut logs according to the results of the sensitive information detection; the second server sends the desensitized logs to a third server; the third server stores the received logs. The container cluster log security protection method of the present invention improves the security of logs and container clusters through log collection, cutting and desensitization technology and setting a server specifically for storing logs, which is conducive to preventing log information from being tampered with and leaked and saving server storage resources.

Description

Container cluster log security protection method, device and storage medium

Technical Field

The present invention relates to the technical field of container cluster log security protection, and in particular to a container cluster log security protection method, device and storage medium.

Background Art

The existing method of viewing container cluster logs is usually to log in to the server of the container cluster and execute relevant log viewing commands to directly view the logs, but this viewing method has many problems: first, it does not conform to the principle of minimization of permissions. Just to perform the task of log viewing, the container cluster needs to open the login permission of the entire server, and the server has potential security risks; common container cluster logs have a lot of information, there is a lot of useless information, and are directly stored in the local server of the container cluster, occupying server storage resources and there is a risk of tampering, and some logs contain sensitive information, such as user passwords, database connection information, etc., there is a potential risk of information leakage; and some log viewing commands are performed through log collection, which is collected by embedding points in the business or invading third-party code, which is easy to affect business performance or increase the failure rate.

Summary of the invention

The purpose of the present invention is to provide a container cluster log security protection method, device and storage medium, which improves the security of logs and container clusters through log collection, cutting and desensitization technology and setting up a server specifically for storing logs, which is beneficial to avoid tampering and leakage of log information and save server storage resources.

In order to achieve the above object, the present invention discloses a container cluster log security protection method, which includes:

The first server collects logs of the container cluster through a collection program;

The first server sends the collected logs to the second server;

The second server cuts the received logs;

The second server performs sensitive information detection on the cut logs, and performs desensitization processing on the cut logs according to the results of the sensitive information detection;

The second server sends the desensitized log to the third server;

The third server stores the received logs.

Furthermore, before the “the first server collects logs of the container cluster through a collection program”, the method further includes:

The container cluster reclaims login permissions and locks the permissions and channels for viewing logs.

Further, the collection program includes an agent program developed based on the eBPF technology, and the “the first server collects logs of the container cluster through the collection program” includes:

The first server deploys the agent program to the container cluster;

The first server is connected to the container cluster through the agent program;

The agent program collects all logs of the container cluster without intrusion.

The container cluster sends the full log collected by the agent program to the first server.

Furthermore, before the “the first server sends the collected logs to the second server”, the method further includes:

The first server sends a log cutting request to the second server.

Further, the “second server cutting the received log” includes:

The second server splits the received log into individual logs;

The second server filters and retains the logs containing key information in the single log.

Furthermore, the desensitization process includes hiding sensitive keywords in the log.

In order to achieve the above object, the present invention discloses an electronic device, which includes:

one or more processors;

One or more memories are used to store one or more programs. When one or more of the programs are executed by the processor, the processor implements the container cluster log security protection method as described above.

In order to achieve the above-mentioned object, the present invention discloses a computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, the container cluster log security protection method as described above is implemented.

The present application sets up three servers to collect, cut, desensitize and store logs. The first server collects the logs of the container cluster through a collection program and sends them to the second server. The second server is responsible for cutting and sensitive information detection of the received logs, and desensitizing the cut logs according to the results of sensitive information detection. The third server is responsible for receiving and storing the desensitized logs. The above method is used to improve the security of logs and container clusters, which is conducive to preventing log information from being tampered with and leaked and saving server storage resources.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a method for protecting container cluster log security according to an embodiment of the present invention.

FIG. 2 is a system diagram of an electronic device according to an embodiment of the present invention.

DETAILED DESCRIPTION

In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

Embodiment 1

Referring to FIG. 1 , the present invention discloses a container cluster log security protection method, which includes:

Furthermore, before “the first server collects logs of the container cluster through a collection program”, the method further includes:

1010. The container cluster reclaims login permissions and locks the permissions and channels for viewing logs.

It is understandable that before processing the logs of the container cluster, the k8s container cluster implements the principle of minimizing server permissions by reclaiming the permission to directly log into its server and locking all the original permissions and channels for viewing the logs, so as to prohibit directly viewing the logs of the container cluster by logging into the server, thereby improving the security of the container cluster server, and the same container cluster only needs to perform operation 1010 once, and there is no need to repeat it later, but this is not limited to this.

101. The first server collects logs of the container cluster through a collection program;

Furthermore, the collection program includes an agent program developed based on the eBPF technology, and “the first server collects logs of the container cluster through the collection program” includes:

1011. The first server deploys the agent program to the container cluster;

1012. The first server is connected to the container cluster through the agent program;

1013. The agent program collects all logs of the container cluster without intrusion;

1014. The container cluster sends the full log collected by the agent program to the first server.

It can be understood that, in combination with eBPF technology (which can enable the program to run without modifying the kernel source code or adding additional kernel modules), an agent program for zero-intrusive collection of container cluster logs is developed and deployed on the k8s container cluster as the log source, and a first server that can connect to the agent program on the k8s container cluster is developed, so that the first server uses eBPF technology to collect logs on the k8s container cluster without intrusiveness, which is conducive to obtaining container cluster logs without destroying business integrity, affecting business performance, and increasing business failure rate.

Furthermore, before “the first server sends the collected logs to the second server”, the method further includes:

1020. The first server sends a log cutting request to the second server.

102. The first server sends the collected logs to the second server;

103. The second server cuts the received logs;

Furthermore, “the second server cuts the received log” includes:

1031. The second server divides the received log into individual logs;

1032. The second server filters and retains the logs containing key information in the single log.

It is understandable that the function of developing the full log segmentation of the second server uses log segmentation technology to first segment the full log into single logs, then remove a large amount of useless log information, and only retain useful key log information, so as to effectively save the resources of the storage log server and improve the efficiency of log query, but it is not limited to this.

104. The second server performs sensitive information detection on the cut logs, and performs desensitization processing on the cut logs according to the result of the sensitive information detection;

Furthermore, the desensitization process includes hiding sensitive keywords in the logs.

It is understandable that the function of detecting and hiding sensitive information in the logs of the second server is developed. The second server automatically detects whether there is sensitive information in the segmented logs, and automatically desensitizes the sensitive information in the logs by hiding the sensitive fields, so as to achieve the purpose of protecting the security of the container cluster logs, but it is not limited to this.

105. The second server sends the desensitized log to the third server;

106. The third server stores the received log.

It is understandable that a third server with log storage and log query functions is developed to save the processed logs to a dedicated log server other than the local server, thereby avoiding the risk of logs on the original container cluster being tampered with.

The present application sets up three servers to collect, cut, desensitize and store logs. The first server collects the logs of the container cluster through a collection program and sends them to the second server. The second server is responsible for cutting and sensitive information detection of the received logs, and desensitizing the cut logs according to the results of sensitive information detection. The third server is responsible for receiving and storing the desensitized logs. The above method is used to improve the security of logs and container clusters, which is conducive to preventing log information from being tampered with and leaked and saving server storage resources.

Embodiment 2

Referring to FIG. 1 and FIG. 2 , the present invention discloses an electronic device, which includes:

One or more processors 301;

One or more memories 302 are used to store one or more programs. When the one or more programs are executed by the processor, the processor implements the container cluster log security protection method as described above.

Embodiment 3

An embodiment of the present application discloses a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the aforementioned container cluster log security protection method is implemented.

Embodiment 4

The embodiment of the present application discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of an electronic device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the electronic device executes the above-mentioned container cluster log security protection method.

It should be understood that in the embodiments of the present application, the processor referred to may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by hardware related to computer program instructions, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims (8)

1. A method for securing a container cluster log, comprising:

the first server collects the logs of the container clusters through a collection program;

The first server sends the collected log to the second server;

the second server cuts the received log;

The second server detects sensitive information of the cut log and desensitizes the cut log according to the detection result of the sensitive information;

The second server sends the desensitized log to a third server;

The third server stores the received log.

2. The method for protecting the log security of a container cluster according to claim 1, wherein before the first server collects the log of the container cluster by the collection program, the method further comprises:

The container cluster recovers the login rights and locks the rights and channels to view the log.

3. The container cluster log security protection method according to claim 1, wherein the collection program comprises a agent program developed based on eBPF technologies, and the "the first server collects the log of the container cluster through the collection program" includes:

the first server deploys the agent program to the container cluster;

the first server is connected with the container cluster through the agent program;

the agent program performs zero invasion collection on the full log of the container cluster;

And the container cluster sends the full log acquired by the agent program to the first server.

4. The method of claim 1, wherein before the first server sends the collected log to the second server, further comprising:

the first server sends a request for a cutting log to the second server.

5. The container cluster log security protection method according to claim 1, wherein the "the second server cuts the received log" comprises:

The second server divides the received log into single logs;

the second server screens and retains the logs with key information in the single log.

6. The container cluster log security protection method of claim 1, wherein the desensitizing process comprises hiding sensitive keywords in the log.

7. An electronic device, comprising:

one or more processors;

One or more memories for storing one or more programs that, when executed by the processor, cause the processor to implement the container cluster log security protection method of any of claims 1 to 6.

8. A computer-readable storage medium having a program stored thereon, wherein the program when executed by a processor implements the container cluster log security protection method according to any one of claims 1 to 6.