JP7327057B2 - CONTAINER CONTROL DEVICE, CONTAINER CONTROL METHOD, AND CONTAINER CONTROL PROGRAM - Google Patents

Description

The present disclosure relates to a container control device, a container control method, and a container control program.

In cloud systems, for example, virtualization technology is used to realize services with high availability. Among virtualization technologies, container-type virtualization technology creates a plurality of logical partitions called containers on one OS (Operating System). A plurality of generated containers are then assigned to individual users and services.

In a cloud system that uses container-type virtualization technology, in addition to controlling container creation/start/stop/deletion, network connections between servers, storage management, and scheduling management such as the servers that run containers and timing. necessary.

Therefore, such a cloud system uses an orchestration tool for automatically performing the above-described complicated management. For example, even if a container terminates abnormally, the orchestration tool can restart the container and continue services provided by applications running in the container.

However, in the public cloud provided by the cloud service provider, if a security vulnerability is discovered in an application or library that runs in multiple containers (hereinafter also referred to as container clusters), the application or library may be exposed by an unspecified number of people There is a risk of being attacked by security vulnerabilities. As a result, in public clouds, attacks can spread not only to container clusters with security vulnerabilities, but also to other container clusters and the public cloud as a whole.

Therefore, in a public cloud, a container cluster with security vulnerabilities cannot be left running and the application or library cannot continue to operate.

Therefore, in the public cloud, when a security vulnerability is discovered in a container, a configuration change must be made to the container cluster to immediately stop it.

Furthermore, in public clouds, there is a problem that the services provided by the container cluster cannot be continued until the security vulnerabilities are resolved by correcting the applications, libraries, etc. that operate in the container cluster.

In response to such a problem, an on-premise private cloud has been proposed instead of a public cloud, in which security specialized for the user's usage can be adopted (Patent Document 1).

Furthermore, a hybrid cloud that combines the advantages of both the public cloud and the private cloud has been proposed. In other words, in a hybrid cloud, a public cloud and a private cloud can be used properly according to the services to be provided and the purpose of use (Patent Document 2).

Japanese translation of PCT publication No. 2014-524096 JP 2017-058985 A

However, providing all services in a private cloud, such as the cloud described in Patent Document 1, is costly, and it is difficult to scalably increase capacity according to the number of service users at low cost. Unable to take advantage of the public cloud where

Also, the cloud described in Patent Document 2 has the same problem as the cloud described in Patent Document 1.

One of the purposes of the present disclosure is to solve the above-described problems and to reduce security risks while continuing services provided by containers in which security vulnerabilities have been detected, and a container control device and container control method. , and to provide a container control program.

A container control device according to one aspect of the present disclosure includes storage means for storing container information indicating one or more modules included in a container, and referring to the container information when a security vulnerability is detected in the module, a control means for stopping the container in the public cloud and starting the container in the private cloud when the container including the module is running in the public cloud.

A container control method according to one aspect of the present disclosure stores container information indicating one or more modules included in a container, and when a security vulnerability is detected in the module, the container information is referred to, and the module is If the containing container is running in the public cloud, stop the container in the public cloud and start the container in the private cloud.

A container control program according to one aspect of the present disclosure stores container information indicating one or more modules included in a container in a computer, and refers to the container information when a security vulnerability is detected in the module, If the container containing the module is running on the public cloud, the process of stopping the container on the public cloud and starting the container on the private cloud is executed.

An effect of the present disclosure is that it is possible to reduce security risks while continuing services provided by containers in which security vulnerabilities have been discovered.

1 is a block diagram showing the configuration of a container control system 100 according to a first embodiment; FIG. 3 is a diagram showing a detailed configuration of a cloud in the first embodiment; FIG. 4 is a diagram showing an example of security information in the first embodiment; FIG. 4 is a diagram showing an example of container information in the first embodiment; FIG. FIG. 4 is a diagram showing the state of each cloud before container switching processing according to the first embodiment; FIG. 10 is a diagram showing the state of each cloud after container switching processing according to the first embodiment; 4 is a flowchart showing container switching processing in the first embodiment. FIG. 3 is a block diagram showing the configuration of a container control system 110 according to a second embodiment; FIG. FIG. 11 is a block diagram showing the configuration of a container control device 10 in a third embodiment; FIG. 5 is a block diagram showing an example of the hardware configuration of computer 500. FIG.

Embodiments will be described in detail with reference to the drawings. In addition, in each drawing and each embodiment described in the specification, the same reference numerals are given to the same constituent elements, and the description thereof will be omitted as appropriate.

(First embodiment)
A first embodiment will be described.

First, the configuration of the container control system 100 according to the first embodiment will be described. FIG. 1 is a block diagram showing the configuration of a container control system 100 according to the first embodiment. Referring to FIG. 1 , container control system 100 includes public cloud 201 , private cloud 301 and container control device 401 . Also, in this specification, the public cloud 201 and the private cloud 301 are collectively referred to as clouds when there is no need to distinguish between them.

The container control device 401, public cloud 201, and private cloud 301 are interconnected via a communication network or the like.

Public cloud 201 includes container clusters 202 and 203 . Private cloud 301 includes container clusters 302 and 303 . The container control device 401 also includes a security information acquisition unit 402 , a storage unit 403 and a control unit 404 .

Public cloud 201 and private cloud 301 have similar configurations for container clusters and containers. However, the public cloud 201 and the private cloud 301 differ in settings of, for example, access control and security software by network control equipment (not shown). For example, in the network control device of the private cloud 301 , access control and security software are set so that the security level is higher than that of the network control device of the public cloud 201 . Further, in the public cloud 201, countermeasures against security vulnerabilities are entrusted to the cloud provider, whereas in the private cloud 301, countermeasures against security vulnerabilities are carried out based on the administrator's own judgment. Therefore, for example, early countermeasures against security vulnerabilities are possible.

It is assumed that the public cloud 201 and the private cloud 301 operate as hybrid clouds. In a hybrid cloud, for example, multiple containers that provide predetermined services operate on a virtual network that straddles the public cloud 201 and the private cloud 301 . In this case, for example, some of the multiple containers may operate in the public cloud 201 and the rest in the private cloud 301 .

Further, each of the public cloud 201 and the private cloud 301 is given a cloud ID, which is an identifier for identifying each cloud, for example. Similarly, when the public cloud 201 and the private cloud 301 have container clusters, each of the container clusters 202, 203, 302, and 303 is given a cluster ID, which is an identifier for identifying each. Each container is given a container ID, which is an identifier used to identify the container.

In this embodiment, cloud ID: 1 indicates the public cloud 201 and cloud ID: 2 indicates the private cloud 301 .

Also, in this embodiment, a container cluster is indicated by combining a cloud ID and a cluster ID. For example, the container cluster 202 is indicated with cloud ID: 1 and cluster ID: 1, and the container cluster 203 is indicated with cloud ID: 1 and cluster ID: 2. Also, for example, the container cluster 302 is indicated with cloud ID: 2 and cluster ID: 1, and the container cluster 303 is indicated with cloud ID: 2 and cluster ID: 2.

FIG. 2 is a diagram showing the detailed configuration of the cloud in the first embodiment. In the explanation of the cloud below, FIG. 2 shows the configuration of the public cloud 201 .

The cloud consists of computers (servers). An OS runs on the computer. On this OS, in addition to controlling the creation/start/stop/deletion of multiple containers, container management that controls network connections between servers, storage management, and scheduling management such as the server and timing for running containers. the software works.

In the example of FIG. 2, container management software controls a container cluster formed of three containers. An identifier is assigned to each container to identify it. For example, the container 1 is given a container ID of 1, the container 2 is given a container ID of 2, and the container 3 is given a container ID of 3. Container 1 includes module A and module B. Container 2 includes module C and module D. Container 3 also includes module E and module F.

Note that in the example of FIG. 1, the container control device 401 is connected to the public cloud 201 and the private cloud 301 via networks. However, the present invention is not limited to this, and the container control device 401 may be arranged in the public cloud 201 or the container control device 401 may be arranged in the private cloud 301 .

The security information acquisition unit 402 acquires, via the Internet, security information related to modules included in a container (to be described later) that operates in the cloud from, for example, a site that provides security vulnerability information.

Here, the modules included in the container refer to the code and setting information of the application to be run in the container, the middleware required to run the application, the software such as the library on which the application depends, or the functional means divided.

The security information also includes module names that have security vulnerabilities. In this embodiment, the security information includes the name of a module having a security vulnerability, but the present invention is not limited to this. The security information may include, for each module, the version of the module that has the security vulnerability. Additionally, security information may include dependencies between modules that create security vulnerabilities for the modules.

In the security information acquisition unit 402, the URL of the site may be set in advance so that the site providing the security vulnerability information service can be accessed. As a result, the security information acquisition unit 402 can acquire security information by accessing a site that provides a service for providing security vulnerability information at any time.

FIG. 3 is a diagram showing an example of security information in the first embodiment. As shown in FIG. 3, the security information includes the name of a module judged to have a security vulnerability by the security information service provider.

The storage unit 403 stores container information. The container information includes location information about containers operating in the cloud and module information about modules included in the containers.

FIG. 4 is a diagram showing an example of container information in the first embodiment. The container information includes, as shown in FIG. 4, arrangement information including cloud IDs, cluster IDs, and container IDs, and module information including module names.

In this embodiment, the container information includes the location information and the module information, the location information includes the cloud ID, the cluster ID, and the container ID, and the module information includes the module name. Not limited. For example, the module information of the container information may include versions of modules included in each container and dependencies between modules. In this case, even if the modules are the same, the versions may differ due to the dependencies between the modules to be operated in the container. Further, as the arrangement information of the container information, a method other than the identifier may be used as long as the arrangement of the containers can be specified.

Also, in this embodiment, it is assumed that containers configured by the same modules are arranged in the public cloud 201 and the private cloud 301, the container in one cloud is started, and the container in the other cloud is stopped. In the example of FIG. 4, for example, a container with cloud ID: 1, cluster ID: 1, and container ID: 1 configured by modules A and B is in the public cloud 201, and cloud ID: 2 and cluster A container with ID: 1 and container ID: 1 is placed in the private cloud 301 . Note that the present invention is not limited to this, and the modules that make up the container may be arranged in the cloud when the container is started, and the modules that make up the container may be deleted from the cloud when the container is stopped.

In the present embodiment, the container information is stored in the storage unit 403 in advance. However, the container information may be requested to container management software (container cluster), for example.

Also, the storage unit 403 may store the security information acquired by the security information acquisition unit 402 .

The control unit 404 compares the container information stored in advance in the storage unit 403 with the security information acquired by the security information acquisition unit 402 . Then, the control unit 404 determines whether or not the module of each container has a security vulnerability based on the comparison result.

Specifically, the control unit 404 compares, for example, the module name of the module information included in the container information and the module name included in the security information. Then, the control unit 404 detects the container information and the security information that have the same module name. When the control unit 404 detects a matching module name based on the comparison result, the control unit 404 acquires the arrangement information of the container including the matching module name.

For example, as a specific example, the control unit 404 compares the security information shown in FIG. 3 with the container information shown in FIG. That is, the control unit 404 searches for the module name of the module information included in the container information shown in FIG. 4 using the module name of the security information shown in FIG. Then, the control unit 404 determines that module E of the container with cloud ID: 1, cluster ID: 1, and container ID: 3 has a security vulnerability. Then, the control unit 404 acquires cloud ID: 1, cluster ID: 1, and container ID: 3, which are location information of the container containing the module E having the security vulnerability.

When detecting a module having a security vulnerability, the control unit 404 identifies a container having a security vulnerability based on the obtained container arrangement information. In this embodiment, the control unit 404 identifies the container with container ID: 3 (indicating container 3 in FIG. 2) included in the container cluster 202 of the public cloud 201 .

If the identified container is included in the private cloud 301, the control unit 404 may notify the administrator of the private cloud 301 that there is a container with security vulnerability. By doing so, the container control device 401 can prompt the administrator of the private cloud 301 to deal with the security vulnerability.

Further, when the specified container is included in the public cloud 201, the control unit 404 inquires of the container management software operating in the public cloud 201 whether the specified container has been activated.

If the specified container has not been started in the public cloud 201, the control unit 404 may notify the administrator of the public cloud 201 that there is a container having a security vulnerability. By doing so, the container control device 401 can prompt the administrator of the public cloud 201 to take action against the security vulnerability before the container having the security vulnerability is activated.

If the specified container is running in the public cloud 201, the control unit 404 requests the container management software to stop the specified container. The control unit 404 then requests the container management software of the private cloud 301 to start the same container as the specified container. In this embodiment, the container with container ID: 3 included in the container cluster 302 of the private cloud 301 is activated.

Switching of containers (hereinafter also referred to as container switching processing) performed by the container control device 401 will be described using a specific example.

FIG. 5 is a diagram showing the state of each cloud before container switching processing in the first embodiment. In the public cloud 201 shown in FIG. 5, a container cluster 202 uses containers 1 to 3 to provide predetermined services. In the private cloud 301, as indicated by the hatched container, a container cluster 302 having the same configuration as the container cluster 202 of the public cloud 201 (cloud ID: 1) is placed without starting.

The control unit 404 of the container control device 401 detects the module having the security vulnerability as described above, that is, based on the security information shown in FIG. 3 and the container information shown in FIG. It is determined that module E included in container 3 (container ID: 3) of container cluster 202 (cluster ID: 1) of (cloud ID: 1) has a security vulnerability.

FIG. 6 is a diagram showing the state of each cloud after container switching processing according to the first embodiment.

After confirming that the container 3 has been activated, the control unit 404 requests the container management software of the public cloud 201 to stop the hatched container 3 . Based on the request from the control unit 404 , the container management software of the public cloud 201 stops the hatched container 3 .

Next, the control unit 404 requests the container management software of the private cloud 301 to start the container 3 (container ID: 3) of the container cluster 302 (cluster ID: 1) of the private cloud 301 (cloud ID: 2). The container management software of the private cloud 301 activates the container 3 based on the request from the control unit 404 . Note that the hatched other containers 1 and 2 remain arranged in the private cloud 301 without being activated.

With such a configuration, even if a security vulnerability is detected in a container included in the public cloud 201 , the container control device 401 can start the container having the security vulnerability in the private cloud 301 . Then, the container control device 401 causes the containers 1 and 2 of the container cluster 202 of the public cloud 201 and the container 3 of the container cluster 302 of the private cloud 301 to cooperate with each other, so that the container cluster 201 of the public cloud 201 has containers 1 to 3. 3 can be continued.

Next, operation of the first embodiment will be described.

The container switching process will be explained.

FIG. 7 is a flowchart showing container switching processing in the first embodiment. The container switching process is executed, for example, each time an update of security vulnerability information is notified from a security vulnerability information provider.

The security information acquisition unit 402 acquires security information from a service provider of information on security vulnerabilities (step S10). The control unit 404 compares the obtained security information with the container information stored in the storage unit 403 (step S11).

Next, the control unit 404 detects containers including modules having security vulnerabilities based on the comparison result (step S12). In step S12, if no container having a security vulnerability is detected (NO in step S12), the control unit 404 terminates the container switching process.

If a container having a security vulnerability is detected in step S12 (YES in step S12), the control unit 404 acquires container arrangement information from the container information of the detected container (step S13).

Based on the acquired arrangement information, the control unit 404 determines whether the detected container is arranged in the public cloud 201 or in the private cloud 301 (step S14).

If it is determined in step S14 that the detected container is not located in the public cloud 201, that is, it is located in the private cloud 301 (NO in step S14), the control unit 404 causes the container included in the private cloud 301 to The administrator of the private cloud 301 is notified that there is a security vulnerability (step S15), and the container switching process ends.

If it is determined in step S14 that the detected container is located in the public cloud 201 (YES in step S14), the control unit 404 determines whether the detected container is running on the public cloud 201 or whether the detected container is public. An inquiry is made to the container management software of the public cloud 201 as to whether it has been started in the cloud 201 (step S16).

In step S16, as a result of the inquiry, if the detected container has not been started in the public cloud 201 (NO in step S16), the control unit 404 detects that the container included in the public cloud 201 has a security vulnerability. 201 is notified (step S15), and the container switching process ends.

In step S16, as a result of the inquiry, if the detected container has been started in the public cloud 201 (YES in step S16), the control unit 404 requests the container management software of the public cloud 201 to stop the detected container. (Step S17). Then, the container management software of the public cloud 201 stops the container having the security vulnerability.

Next, the control unit 404 requests the container management software of the private cloud 301 to start the same container as the detected container (step S18). Then, the container management software of the private cloud 301 activates the same container as the container having the security vulnerability, and the container switching process ends.

The above completes the operation of the first embodiment.

Next, effects of the first embodiment will be described.

According to the first embodiment, the security risk can be suppressed while continuing the service provided by the container in which the security vulnerability has been detected. The reason for this is to stop the container running in the public cloud where security vulnerabilities have been detected, and start the same container as the stopped container in the private cloud, which is generally considered to be more secure than the public cloud. This is because

According to the first embodiment, it is possible to shorten the time from acquisition of security vulnerability information to completion of container switching processing. The reason for this is that the container control device 401 is configured to collect security vulnerability information and take action when a module with security vulnerability is included in the container.

(Second embodiment)
In the second embodiment, instead of simply switching a container having a security vulnerability from a public cloud to a private cloud to operate it, in the private cloud, a predetermined server or VM (Virtual Machine) or the like designated by the user in advance is used. Start the container in the environment.

A second embodiment will be described.
FIG. 8 is a block diagram showing the configuration of a container control system 110 according to the second embodiment. The private cloud 310 includes a container cluster 302 and a VM 313, which is a predetermined environment specified in advance by the user.

When a container having a security vulnerability is detected in the public cloud 201, the control unit 404 of the container control device 401 requests the container management software of the public cloud 201 to stop the container, and restores the same container as the private container. A request is made to the container management software of the private cloud 310 to start the VM 313 of the cloud 310 .

As a result, the container management software of the public cloud 201 can stop the container having the security vulnerability, and the container management software of the private cloud 310 can start the same container on the VM 313 .

Next, effects of the second embodiment will be described.

According to the second embodiment, even if a container having a security vulnerability is operated on a private cloud and a failure occurs, the impact range of the failure can be limited to a predetermined range, which facilitates failure analysis. Is possible. The reason for this is that the container control device 401 activates a container having a security vulnerability by limiting it to an environment specified in advance by the user of the private cloud.

(Third embodiment)
A third embodiment will be described.

FIG. 9 is a block diagram showing the configuration of the container control device 10 in the third embodiment.

Referring to FIG. 9 , container control device 10 includes storage unit 11 and control unit 12 . The storage unit 11 and the control unit 12 are embodiments of storage means and control means, respectively. Note that the storage unit 11 and the control unit 12 have the same configurations as the storage unit 403 and the control unit 404 in the first embodiment, and realize functions equivalent to those of the storage unit 403 and the control unit 404 .

The storage unit 11 stores container information indicating one or more modules included in the container. In this embodiment, the container information may be stored in the storage unit 11 in advance, or the container information may be acquired from public clouds and private clouds.

The control unit 12 refers to container information stored in the storage unit 11, for example, when a security vulnerability is detected in a module. When a module having security vulnerability is detected as a result of referring to the container information, the control unit 12 determines whether the container including the module having security vulnerability is operating in the public cloud based on the container information. to judge. When the control unit 12 determines that a container including a module having security vulnerability is operating in the public cloud as a result of the determination, the control unit 12 stops the container in the public cloud. Then, the control unit 12 starts a container having the same configuration as the container in the private cloud.

Next, effects of the third embodiment will be described.

According to the third embodiment, the security risk can be suppressed while continuing the service provided by the container in which the security vulnerability has been detected. The reason for this is to stop the container running in the public cloud where security vulnerabilities have been detected, and start the same container as the stopped container in the private cloud, which is generally considered to be more secure than the public cloud. This is because

(Hardware configuration)
In each of the above-described embodiments, each component of the container control device 401 represents a functional unit block. A part or all of each component of the container control device 401 may be realized by any combination of the computer 500 and a program.

FIG. 10 is a block diagram showing an example of the hardware configuration of the computer 500. As shown in FIG. Referring to FIG. 10, a computer 500 includes, for example, a CPU (Central Processing Unit) 501, a ROM (Read Only Memory) 502, a RAM (Random Access Memory) 503, a program 504, a storage device 505, a drive device 507, and a communication interface 508. , an input device 509 , an output device 510 , an input/output interface 511 and a bus 512 .

The program 504 includes instructions for realizing each function of the container control device 401 . The program 504 is stored in advance in the ROM 502 , RAM 503 and storage device 505 . The CPU 501 implements each function of the container control device 401 by executing instructions included in the program 504 . For example, the CPU 501 implements the functions of the security information acquisition unit 402 by executing instructions included in the program 504 . Also, the RAM 503 may store data processed in each function of the container control device 401 . For example, the RAM 503 may store data in the storage unit 403 .

A drive device 507 reads from and writes to a recording medium 506 . Communication interface 508 provides an interface with a communication network. The input device 509 is, for example, a mouse, a keyboard, or the like, and receives input of information from an administrator or the like. The output device 510 is, for example, a display, and outputs (displays) information to an administrator or the like. The input/output interface 511 provides an interface with peripheral devices. A bus 512 connects each of these hardware components. The program 504 may be supplied to the CPU 501 via a communication network, or may be stored in the recording medium 506 in advance, read by the drive device 507 and supplied to the CPU 501 .

Note that the hardware configuration shown in FIG. 10 is an example, and components other than these may be added, or some components may be omitted.

There are various modifications of the method for realizing the container control device 401 . For example, the container control device 401 may be realized by an arbitrary combination of computers and programs that are different for each component. Also, a plurality of components included in the container control device 401 may be realized by any combination of a single computer and a program.

Also, part or all of each component of the container control device 401 may be realized by a general-purpose or dedicated circuit including a processor or the like, or a combination thereof. These circuits may be composed of a single chip, or may be composed of multiple chips connected via a bus. A part or all of each component of the container control device 401 may be implemented by a combination of the above-described circuits and the like and programs.

In addition, when a part or all of each component of the container control device 401 is realized by a plurality of computers, circuits, etc., the plurality of computers, circuits, etc. may be arranged centrally or distributedly. .

Also, the container control device 401 may be located in the public cloud 201 or the private cloud 301, or may be located in a different location and connected to the public cloud 201 and private cloud via a communication network. That is, the container control device 401 may be realized by a cloud computing system.

Although the present disclosure has been described with reference to the embodiments, the present disclosure is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Also, the configurations in each embodiment can be combined with each other without departing from the scope of the present disclosure.

10, 401 container control device 11, 403 storage unit 12, 404 control unit 100, 110 container control system 201 public cloud 202, 203, 302, 303 container cluster 301, 310 private cloud 313 VM
402 security information acquisition unit 500 computer 501 CPU
502 ROMs
503 RAM
504 program 505 storage device 506 recording medium 507 drive device 508 communication interface 509 input device 510 output device 511 input/output interface 512 bus

Claims (9)

storage means for storing container information indicating one or more modules included in the container;
When a security vulnerability is detected in the module, the container information is referenced, and if a container including the module is running in the public cloud, the container is stopped in the public cloud and started in the private cloud. a control means for activating a container having the same configuration as the container containing the module, which is arranged without the module ;
A container control device comprising: further comprising security information acquisition means for acquiring security information about security vulnerabilities,
The container control device according to claim 1, wherein the control means detects security vulnerability of the module based on the security information. The security information includes dependencies between modules that create security vulnerabilities with respect to the modules.
The container control device according to claim 2. 4. The control means according to any one of claims 1 to 3, wherein when the module has a security vulnerability, the control means starts a container having the same configuration as the container containing the module in a predetermined environment in the private cloud. Container control device. the computer
storing container information indicating one or more modules included in the container;
referring to the container information when a security vulnerability is detected in the module;
if the container containing the module is running in the public cloud, stop the container in the public cloud;
A container control method for starting a container having the same configuration as a container including the module, which is arranged without being started in a private cloud. the computer
In addition, obtain security information about security vulnerabilities,
6. The container control method according to claim 5 , wherein security vulnerability of said module is detected based on said security information. The security information includes dependencies between modules that create security vulnerabilities with respect to the modules.
The container control method according to claim 6. the computer
8. The container control method according to any one of claims 5 to 7 , wherein when the module has a security vulnerability, a container having the same configuration as the container containing the module is started in a predetermined environment in the private cloud. to the computer,
storing container information indicating one or more modules included in the container;
referring to the container information when a security vulnerability is detected in the module;
if the container containing the module is running in the public cloud, stop the container in the public cloud;
A container control program that executes a process of starting a container that has the same configuration as a container that contains the module and that has been placed without being started in a private cloud.

Images