CN106169994A - The method of controlling security communicated between container and device - Google Patents

Abstract

Embodiments of the present invention provide a security control method and device for inter-container communication. The method includes: the first virtual container gateway receives the access request sent by the source Docker container; the first virtual container gateway obtains the address information of the second virtual container gateway corresponding to the first virtual container gateway, and the second virtual container gateway and the target Docker container Correspondingly: the first virtual container gateway sends the access request to the second virtual container gateway according to the address information of the second virtual container gateway, so that the second virtual container gateway forwards the access request to the target Docker container. The embodiments of the present invention can realize the directional communication between Docker containers through the directional communication between the virtual container gateways, and ensure the reliability of the communication between the Docker containers.

Description

Security control method and device for inter-container communication

technical field

Embodiments of the present invention relate to the technical field of communication, and in particular, to a security control method and device for inter-container communication.

Background technique

Docker is an open source application container engine. After installing Docker on a physical host, multiple containers can be hosted on the basis of Docker. Multiple containers are isolated from each other. Multiple containers share the operating system of the physical host, and each container can be placed and execute different applications.

The physical host on which the Docker container is installed is called a Docker server. For example, Docker container 1 is in Docker server 1, and Docker container 2 is in Docker server 2. When Docker container 1 needs to access Docker container 2 as a client, Docker container 1 is created Request message, the source IP address of the request message is the IP address of Docker server 1, and the destination IP address is the IP address of Docker server 2.

However, when Docker container 2 is migrated from Docker server 2 to other Docker servers, Docker container 1 will not be able to communicate with Docker container 2, which reduces the reliability of communication between Docker containers, and thus cannot guarantee the directional communication between Docker containers .

Contents of the invention

Embodiments of the present invention provide a security control method and device for inter-container communication, so as to improve the reliability of communication between Docker containers and ensure directional communication between Docker containers.

An aspect of the embodiments of the present invention is to provide a security control method for inter-container communication, including:

The first virtual container gateway receives the access request sent by the source Docker container, and the access request includes the first subnet address of the target Docker container;

The first virtual container gateway obtains address information of a second virtual container gateway corresponding to the first virtual container gateway, where the second virtual container gateway corresponds to the target Docker container;

The first virtual container gateway sends the access request to the second virtual container gateway according to the address information of the second virtual container gateway, so that the second virtual container gateway forwards the access request to The target Docker container.

Another aspect of the embodiments of the present invention is to provide a security control device for inter-container communication, including:

The receiving module is used to receive the access request sent by the source Docker container, and the access request includes the first subnet address of the target Docker container;

An obtaining module, configured to obtain address information of a second virtual container gateway corresponding to the first virtual container gateway, where the second virtual container gateway corresponds to the target Docker container;

A sending module, configured to send the access request to the second virtual container gateway according to the address information of the second virtual container gateway, so that the second virtual container gateway forwards the access request to the Target Docker container.

The security control method and device for inter-container communication provided by the embodiments of the present invention, through directional communication between virtual container gateways, both the source Docker container and the target Docker container are migrated from one Docker server to another Docker server, After the migration, the virtual container gateways corresponding to the source Docker container and the target Docker container have changed, but through the directional communication between the virtual container gateways, the directional communication between the Docker containers can still be realized, ensuring the reliability of the communication between the Docker containers sex.

Description of drawings

FIG. 1 is a flowchart of a security control method for inter-container communication provided by an embodiment of the present invention;

Fig. 2 is a network structure diagram applicable to the security control method for inter-container communication provided by the embodiment of the present invention;

FIG. 3 is a flowchart of a security control method for inter-container communication provided by another embodiment of the present invention;

FIG. 4 is a structural diagram of a security control device for inter-container communication provided by an embodiment of the present invention;

Fig. 5 is a structural diagram of a security control device for inter-container communication provided by another embodiment of the present invention.

detailed description

FIG. 1 is a flowchart of a security control method for inter-container communication provided by an embodiment of the present invention; FIG. 2 is a network structure diagram applicable to the security control method for inter-container communication provided by an embodiment of the present invention. The embodiment of the present invention aims at that when the Docker container 2 is migrated from the Docker server 2 to other Docker servers, the Docker container 1 will not be able to communicate with the Docker container 2, which reduces the reliability of the communication between the Docker containers, and thus cannot guarantee the communication between the Docker containers. Directed communication provides a security control method for inter-container communication. The steps of the method are as follows:

Step S101, the first virtual container gateway receives the access request sent by the source Docker container, and the access request includes the first subnet address of the target Docker container;

As shown in Figure 2, the Docker container 21, the Docker container 22 and the Docker engine 31 are located at the Docker server 11, the Docker engine 32 is located at the Docker server 12, the Docker container 22 can be migrated from the Docker server 11 to the Docker server 12, and the container gateway 40 can be connected with the Docker server 12 respectively. The Docker engine 31 communicates with the Docker engine 32 , and the orchestrator 30 can communicate with the Docker server 11 and the Docker server 12 respectively.

In this embodiment, the container gateway 40 may include multiple virtual container gateways, and the number of virtual container gateways in the container gateway 40 is determined according to the number of subnets to which the containers connected to the container gateway 40 belong, for example, a Docker container The subnet address of 21 is 192.168.0.X, and the subnet address of Docker container 22 is 192.168.1.X. If 192.168.0.X and 192.168.1.X belong to different subnets, the container gateway 40 can Two virtual container gateways are included, and the two virtual container gateways include a first virtual container gateway and a second virtual container gateway. It is assumed that the first virtual container gateway corresponds to the Docker container 21 and the second virtual container gateway corresponds to the Docker container 22 .

In this embodiment, the Docker container 21 is the source Docker container, the Docker container 22 is the target Docker container, and the first subnet address of the target Docker container is the subnet address of the Docker container 22, namely 192.168.1.X. The Docker container 21 accesses the Docker container 22 and communicates with the Docker container 22 . Specifically, the Docker container 21 pre-stores the IP address and port number of the first virtual container gateway, and the Docker container 21 sends an access request to the first virtual container network, and the access request includes the subnet address of the Docker container 22, namely 192.168.1 .X.

Step S102, the first virtual container gateway obtains address information of a second virtual container gateway corresponding to the first virtual container gateway, the second virtual container gateway corresponding to the target Docker container;

Specifically, the first virtual container gateway queries the ACL rule to obtain the address information of the second virtual container gateway corresponding to the first virtual container gateway, and the ACL rule includes the address information of the first virtual container gateway and The corresponding relationship of the address information of the second virtual container gateway.

In this embodiment, an Access Control List (ACL) rule for communication between the first virtual container gateway and the second virtual container gateway can be set in advance in the orchestrator 30, for example, the ACL rule allows the first virtual container gateway and the second virtual container gateway to communicate with each other. The second virtual container gateway communicates. In addition, the ACL rule can also include the correspondence between the address information of the first virtual container gateway and the address information of the second virtual container gateway, indicating that the address information of the first virtual container gateway and the second virtual container Gateway address information can be communicated with each other.

Step S103, the first virtual container gateway sends the access request to the second virtual container gateway according to the address information of the second virtual container gateway, so that the second virtual container gateway The request is forwarded to the target Docker container.

After the first virtual container gateway obtains the address information of the second virtual container gateway, it sends the access request to the second virtual container gateway, and the second virtual container gateway checks that the target address in the access request is the subnet address of the Docker container 22, which is 192.168 .1.X, the access request is sent to the Docker container 22.

In addition, in this embodiment, the communication mode between the first virtual container gateway and the source Docker container may be a tunnel mode, and the communication mode between the second virtual container gateway and the target Docker container may also be a tunnel mode.

In the embodiment of the present invention, through the directional communication between the virtual container gateways, both the source Docker container and the target Docker container are migrated, and migrated from one Docker server to another Docker server. After the migration, the source Docker container and the target Docker container respectively correspond to The virtual container gateway has changed, but through the directional communication between virtual container gateways, the directional communication between Docker containers can still be realized, ensuring the reliability of communication between Docker containers.

Fig. 3 is a flowchart of a security control method for inter-container communication provided by another embodiment of the present invention; as shown in Fig. 3, on the basis of the embodiment shown in Fig. 1, the security control method for inter-container communication provided by this embodiment The specific steps are as follows:

Step S301, the first virtual container gateway assigns a second subnet address to the source Docker container;

In this embodiment, the Docker container 21 and the Docker container 22 are in the same subnet, then the first virtual container gateway can assign the second subnet address such as 192.168.0.1 to the Docker container 21, or assign the first subnet address to the Docker container 22. Subnet address such as 192.168.0.2.

Step S302, the first virtual container gateway stores the second subnet address of the source Docker container;

The first virtual container gateway stores the second subnet address 192.168.0.1 of the Docker container 21 and the first subnet address 192.168.0.2 of the Docker container 22 .

Step S303, the first virtual container gateway receives the access request sent by the source Docker container, and the access request includes the first subnet address of the target Docker container;

When the source Docker container, that is, the Docker container 21, needs to communicate with the target Docker container, that is, the Docker container 22, an access request is sent to the first virtual container gateway through a tunnel, and the access request includes the first subnet address of the target Docker container, that is, 192.168.0.2 , and the second subnet address of the source Docker container, which is 192.168.0.1.

Step S304, the first virtual container gateway determines whether the target Docker container and the source Docker container are in the same subnet according to the first subnet address of the target Docker container;

After the first virtual container gateway receives the access request, it obtains the first subnet address of the target Docker container, namely 192.168.0.2, and the second subnet address of the source Docker container, namely 192.168.0.1, from the access request, and determines the address of the target Docker container. Whether the first subnet address and the second subnet address of the source Docker container are in the same subnet.

Step S305, if the target Docker container and the source Docker container are in the same subnet, then send the access request to the target Docker container.

Since 192.168.0.2 and 192.168.0.1 are in the same subnet, the first virtual container gateway does not need to query the second virtual container gateway corresponding to the first virtual container gateway, and just sends the access request to the target Docker container directly.

In this embodiment, after receiving the access request sent by the source Docker container, the first virtual container gateway obtains the first subnet address of the target Docker container, and according to the first subnet address of the target Docker container and the second subnet address of the source Docker container network address, determine whether the target Docker container and the source Docker container are in the same subnet, and if so, directly send the access request to the target Docker container without querying the second virtual container gateway corresponding to the first virtual container gateway, improving Improve the forwarding efficiency of access requests.

Fig. 4 is a structural diagram of a security control device for inter-container communication provided by an embodiment of the present invention. The security control device for inter-container communication provided by the embodiment of the present invention can execute the processing flow provided by the embodiment of the security control method for inter-container communication. As shown in FIG. 4 , the security control device 40 for inter-container communication includes: a receiving module 41, an Module 42, sending module 43, wherein, receiving module 41 is used for receiving the access request that source Docker container sends, and described access request includes the first subnet address of target Docker container; Obtaining module 42 is used for obtaining and described first virtual The address information of the second virtual container gateway corresponding to the container gateway, the second virtual container gateway corresponding to the target Docker container; the sending module 43 is configured to send the access request to the second virtual container gateway according to the address information of the second virtual container gateway sent to the second virtual container gateway, so that the second virtual container gateway forwards the access request to the target Docker container.

The security control device for inter-container communication provided by the embodiment of the present invention can be specifically used to execute the method embodiment provided in FIG. 1 above, and the specific functions will not be repeated here.

In the embodiment of the present invention, through the directional communication between the virtual container gateways, both the source Docker container and the target Docker container are migrated, and migrated from one Docker server to another Docker server. After the migration, the source Docker container and the target Docker container respectively correspond to The virtual container gateway has changed, but through the directional communication between virtual container gateways, the directional communication between Docker containers can still be realized, ensuring the reliability of communication between Docker containers.

Fig. 5 is a structural diagram of a security control device for inter-container communication provided by another embodiment of the present invention. As shown in Figure 5, on the basis of the embodiment shown in Figure 4, the acquisition module 42 includes a query unit 421 and an acquisition unit 422, wherein the query unit 421 is used to query the ACL rule; Address information of a second virtual container gateway corresponding to a virtual container gateway, wherein the ACL rule includes a correspondence relationship between the address information of the first virtual container gateway and the address information of the second virtual container gateway.

The security control device 40 for inter-container communication also includes an assignment module 44 and a storage module 45, wherein the assignment module 44 is used to assign a second subnet address to the source Docker container, and the storage module 45 is used to store the address of the source Docker container. Second subnet address.

Further, the access request also includes the second subnet address of the source Docker container; the security control device 40 for inter-container communication also includes a determination module 46, and the determination module 46 is configured to network address, and determine whether the target Docker container and the source Docker container are in the same subnet.

The sending module 43 is further configured to send the access request to the target Docker container when the target Docker container and the source Docker container are in the same subnet.

The security control device for inter-container communication provided by the embodiment of the present invention can be specifically used to execute the method embodiment provided in FIG. 3 above, and the specific functions will not be repeated here.

In this embodiment, after receiving the access request sent by the source Docker container, the first virtual container gateway obtains the first subnet address of the target Docker container, and according to the first subnet address of the target Docker container and the second subnet address of the source Docker container network address, determine whether the target Docker container and the source Docker container are in the same subnet, and if so, directly send the access request to the target Docker container without querying the second virtual container gateway corresponding to the first virtual container gateway, improving Improve the forwarding efficiency of access requests.

In summary, the embodiment of the present invention uses directional communication between virtual container gateways, and both the source Docker container and the target Docker container are migrated from one Docker server to another Docker server. After the migration, the source Docker container and the target Docker container The virtual container gateways corresponding to the Docker containers have changed, but through the directional communication between the virtual container gateways, the directional communication between the Docker containers can still be realized, ensuring the reliability of the communication between the Docker containers; the first virtual container gateway After receiving the access request sent by the source Docker container, obtain the first subnet address of the target Docker container, and determine the target Docker container and the source Docker container according to the first subnet address of the target Docker container and the second subnet address of the source Docker container. Whether the container is in the same subnet, and if so, the access request is directly sent to the target Docker container without querying the second virtual container gateway corresponding to the first virtual container gateway, which improves the forwarding efficiency of the access request.

In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above-mentioned integrated units implemented in the form of software functional units may be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, and include several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) or a processor (processor) execute the methods described in various embodiments of the present invention. partial steps. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other various media that can store program codes. .

Those skilled in the art can clearly understand that for the convenience and brevity of description, only the division of the above-mentioned functional modules is used as an example for illustration. The internal structure of the system is divided into different functional modules to complete all or part of the functions described above. For the specific working process of the device described above, reference may be made to the corresponding process in the foregoing method embodiments, and details are not repeated here.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (10)

1. the method for controlling security of communication between a container, it is characterised in that including:

First virtual container gateway receives the access request that source Docker container sends, and described access request includes target Docker First subnet address of container；

Described first virtual container gateway obtains the ground of the second virtual container gateway corresponding with described first virtual container gateway Location information, described second virtual container gateway is corresponding with described target Docker container；

Described access request, according to the address information of described second virtual container gateway, is sent by described first virtual container gateway To described second virtual container gateway, so that described access request is transmitted to described target by described second virtual container gateway Docker container.

Method the most according to claim 1, it is characterised in that described first virtual container gateway obtains empty with described first Intend the address information of the second virtual container gateway corresponding to container gateway, including:

Described first virtual container gateway inquiry acl rule, obtains second corresponding with described first virtual container gateway virtual The address information of container gateway, described acl rule includes that the address information of described first virtual container gateway is empty with described second Intend the corresponding relation of the address information of container gateway.

Method the most according to claim 2, it is characterised in that described first virtual container gateway receives source Docker container Before the access request sent, also include:

Described first virtual container gateway gives Docker container allocation the second subnet address, described source；

Described first virtual container gateway stores the second subnet address of described source Docker container.

Method the most according to claim 3, it is characterised in that described access request also includes described source Docker container Second subnet address；

After described first virtual container gateway receives the access request that source Docker container sends, also include:

Described first virtual container gateway, according to the first subnet address of described target Docker container, determines described target Whether Docker container and described source Docker container be in same subnet.

Method the most according to claim 4, it is characterised in that described determine described target Docker container and described source After whether Docker container is in same subnet, including:

If described target Docker container and described source Docker container are in same subnet, the most described first virtual container gateway Described access request is sent to described target Docker container.

6. the safety control of communication between a container, it is characterised in that including:

Receiver module, for receiving the access request that source Docker container sends, described access request includes that target Docker is held First subnet address of device；

Acquisition module, for obtaining the address information of the second virtual container gateway corresponding with described first virtual container gateway, Described second virtual container gateway is corresponding with described target Docker container；

Sending module, for the address information according to described second virtual container gateway, is sent to described by described access request Second virtual container gateway, so that described access request is transmitted to described target Docker and holds by described second virtual container gateway Device.

The safety control of communication between container the most according to claim 6, it is characterised in that described acquisition module bag Include:

Query unit, is used for inquiring about acl rule；

Acquiring unit, for obtaining the address information of the second virtual container gateway corresponding with described first virtual container gateway, Described acl rule includes the address information of described first virtual container gateway and the address information of described second virtual container gateway Corresponding relation.

The safety control of communication between container the most according to claim 7, it is characterised in that also include:

Distribution module, for Docker container allocation the second subnet address, described source；

Memory module, for storing the second subnet address of described source Docker container.

The safety control of communication between container the most according to claim 8, it is characterised in that described access request is also wrapped Include the second subnet address of described source Docker container；

Between described container, the safety control of communication also includes:

Determine module, for the first subnet address according to described target Docker container, determine described target Docker container With described source Docker container whether in same subnet.

The safety control of communication between container the most according to claim 9, it is characterised in that described sending module is also When described target Docker container and described source Docker container are in same subnet, described access request is sent to institute State target Docker container.