CN114662089A - Webpage tamper-proofing method, system, electronic equipment and medium - Google Patents

Abstract

The application discloses a method, a system, electronic equipment and a medium for preventing webpage tampering. By applying the technical scheme of the application, the kernel can be protected by the protection strategy to the container running by the mirror image name of each container, the kernel protection layer is defaulted to prevent any process from modifying the file under the protection directory, and further the file parameters under the targeted protection service directory are realized. Therefore, the problem that files inside the container node cannot be identified and protected due to resource isolation of a virtual system in a server in the existing tamper-proof technology is solved.

Description

Method, system, electronic device and medium for preventing web page tampering

technical field

The present application relates to data processing technology, in particular to a method, system, electronic device and medium for preventing tampering of web pages.

Background technique

In the field of host webpage anti-tampering, the most common solution for webpage anti-tampering is to use the kernel event-triggered protection mechanism, which is closely integrated with the underlying file-driven protection technology of the operating system. To tamper with the protected content can solve a series of risks such as excessive system resource occupation and delay caused by common web embedded anti-tampering software using polling to detect files or web server embedded detection. Provides protection against various dynamic web scripts.

However, the tamper-proof technology in the related art isolates the resources of the virtual system in the server, that is, the container node, which also makes it impossible to identify and protect the files inside the container node.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a method, a system, an electronic device, and a medium for preventing tampering of a webpage. The invention is used to solve the problem in the related art that the existing anti-tampering technology cannot identify and protect the files inside the container node due to the resource isolation of the virtual system in the server.

Wherein, according to an aspect of the embodiments of the present application, a method for preventing tampering of a webpage is provided, including:

Deploy multiple service PODs and protection PODs on container nodes of the service server, where the container nodes are virtual systems deployed in the service server, the service PODs are used for service processing, and the protection PODs are used for Monitor tamper protection status;

Detecting the running parameters of each container node in real time, the running parameters include the container node name, image name, container node ID, creation time, container node running status and tamper protection status;

Acquire all image directories stored in the container node, and generate a protection policy that prohibits modification of parameters under each image directory, wherein each image directory corresponds to a working node.

Optionally, in another embodiment based on the above method of the present application, before deploying multiple service PODs and protection PODs on the container nodes of the service server, the method further includes:

Establish a connection with the client through the protection POD;

Create a management control center, and use the management control center to manage the protection POD. The management includes displaying the tamper protection status of the container node and basic information of the container node. The basic information of the container node includes the name of the container node, the container node System name, container node ID, image name, container node startup parameters, container node creation time, container node running status, container node port mapping information, container node running start and end time.

Optionally, in another embodiment based on the above method of the present application, the managing the protection POD by using the management control center includes:

Send the protection policy to the protection POD using the management control center, and,

The protection policy is sent to the service POD using the protection POD.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

The protection policy is used to instruct the kernel protection layer of the container node to prevent any process from modifying any parameters in the image directory, where the parameters include subdirectories and service parameters in the image directory.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

Determine the business server ID where each container node is located;

When it is detected that the ID of the service server where the container node is located is changed, a container node offset message is generated, and the container node offset message is sent to the management control center.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

Get the received service request message;

Malicious field detection is performed on the service request message, and if it is determined that the service request message has a malicious field, the service request message is intercepted.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

If it is detected that a new container node exists in the service server, install and deploy the corresponding protection POD on the newly added container node; or,

If it is detected that an instruction to delete a container node is executed in the service server, the protection POD on the container node for deletion is uninstalled.

Wherein, according to yet another aspect of the embodiments of the present application, a system for preventing tampering of web pages is provided, which is characterized in that it includes:

a deployment module, configured to deploy multiple service PODs and protection PODs on container nodes of the service server, where the container nodes are virtual systems deployed in the service server, and the service PODs are used for service processing, The protection POD is used to monitor the tamper protection status;

a detection module, configured to detect the running parameters of each container node in real time, the running parameters include the container node name, image name, container node ID, creation time, container node running status and tamper protection status;

The generating module is configured to obtain all the image directories saved in the container node, and generate a protection policy forbidding modification of parameters under each image directory, wherein each image directory corresponds to a working node.

According to yet another aspect of the embodiments of the present application, an electronic device is provided, comprising:

memory for storing executable instructions; and

The display is used to execute the executable instructions with the memory to complete the operation of any one of the above-mentioned methods for preventing tampering of a webpage.

According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided for storing computer-readable instructions, and when the instructions are executed, the operations of any one of the foregoing methods for preventing tampering of webpages are performed.

In this application, multiple service PODs and protection PODs may be deployed on the container node of the service server, where the container node is a virtual system deployed in the service server, the service POD is used for service processing, and the protection POD is used for monitoring Tamper protection status; real-time detection of running parameters of each container node, running parameters include container node name, image name, container node ID, creation time, container node running status and tamper protection status; obtain all image directories saved in container nodes, And generate a protection policy that prohibits modification of parameters under each mirror directory, where each mirror directory corresponds to a worker node. By applying the technical solution of the present application, it is possible to realize the kernel protection of the container running under the name of each container image through the protection strategy, and the default kernel protection layer prevents any process from modifying the files in the protection directory, thereby realizing targeted protection of the files in the business directory. parameter. Thus, the problem that the existing anti-tampering technology cannot identify and protect the files inside the container node due to resource isolation of the virtual system in the server is avoided.

The technical solutions of the present application will be described in further detail below through the accompanying drawings and embodiments.

Description of drawings

The accompanying drawings, which form a part of the specification, illustrate embodiments of the application and together with the description serve to explain the principles of the application.

The present application may be more clearly understood from the following detailed description with reference to the accompanying drawings, wherein:

1 is a schematic diagram of a method for preventing tampering of a webpage proposed by the application;

2 is a schematic diagram of a system architecture for preventing tampering of a webpage proposed by the application;

3 is a schematic structural diagram of a web page tamper-proof electronic system proposed by the application;

FIG. 4 is a schematic structural diagram of an electronic device for preventing webpage tampering proposed by the present application.

Detailed ways

Various exemplary embodiments of the present application will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of the components and steps, the numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present application unless specifically stated otherwise.

Meanwhile, it should be understood that, for the convenience of description, the dimensions of various parts shown in the accompanying drawings are not drawn in an actual proportional relationship.

The following description of at least one exemplary embodiment is merely illustrative in nature and is not intended to limit the application or its application or uses in any way.

Techniques, methods, and apparatus known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, such techniques, methods, and apparatus should be considered part of the specification.

It should be noted that like numerals and letters refer to like items in the following figures, so once an item is defined in one figure, it does not require further discussion in subsequent figures.

In addition, the technical solutions between the various embodiments of the present application can be combined with each other, but must be based on the realization by those of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be realized, it should be considered that the combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

It should be noted that all directional indications (such as up, down, left, right, front, back...) in the embodiments of the present application are only used to explain the relationship between the various components under a certain posture (as shown in the drawings). If the specific posture changes, the directional indication also changes accordingly.

The following describes a method for preventing tampering of a webpage according to an exemplary embodiment of the present application with reference to FIGS. 1-2 . It should be noted that the following application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the embodiments of the present application are not limited in this respect. Rather, the embodiments of the present application can be applied to any scenario where applicable.

The present application also provides a method, system, electronic device and medium for preventing tampering of a webpage.

FIG. 1 schematically shows a schematic flowchart of a method for preventing tampering of a webpage according to an embodiment of the present application. As shown in Figure 1, the method includes:

S101, deploying multiple service PODs and protection PODs on a container node of the service server, where the container node is a virtual system deployed in the service server, the service PODs are used for service processing, and the protection PODs Used to monitor tamper protection status.

S102, real-time detection of the running parameters of each of the container nodes, where the running parameters include the container node name, image name, container node ID, creation time, container node running status and tampering protection status;

S103: Acquire all image directories stored in the container node, and generate a protection policy that prohibits modification of parameters under each image directory, wherein each image directory corresponds to a worker node.

In related technologies, with the migration of services to the cloud, the containerization of website services in public clouds/private clouds is becoming more and more popular. Most of the traditional anti-tampering technical solutions are based on directory monitoring and kernel-driven protection technologies to prevent web applications and web content from being incompatible. It has been tampered with, but due to the resource isolation of the container, the content in the container cannot be identified. In addition, due to the elastic shrinkage of the container and the high availability mechanism will drift in the actual cluster environment, the traditional directory detection technology cannot achieve the internal file of the container. Therefore, how to prevent malicious data from being implanted in the website under the container, and ensure the normality of the webpage, it is necessary to reconsider a new protection mechanism in the container environment.

Specifically, in the field of host web page tamper-proofing, the most common solution for web page tampering is to use the kernel event-triggered protection mechanism, which is closely integrated with the underlying file-driven protection technology of the operating system. Even if the server is attacked by hackers, operations management The protected content cannot be tampered with the user's authority, which can solve a series of problems such as excessive system resource occupation and delay, etc. Risk, and can provide protection against various dynamic web scripts.

The corresponding technology has undergone the same transformation in the face of business containerization. At present, most of the technical solutions are that the web page tamper-proof monitoring client is connected with the web page tamper-proof management background and the Docker daemon to monitor the site. Anti-attack status, implement policies configured by the management center, and prevent various tampering attacks. But there are the following problems:

Containers isolate system resources, and traditional anti-tampering technical solutions cannot identify and protect files inside containers.

Further, in order to solve the above problems, the present application proposes a method for preventing tampering of web pages, including:

In this application, the management control center needs to be constructed first, and then the client is installed on the protection POD, so that the secure connection between the management control center and the client can be realized. In one way, the user can view the detailed information related to the business in the management control center, configure and issue security policies in the management center, and be responsible for and monitor the business file transfer, log alarm, system status of the terminal through the transmission service module and the communication module. etc. data.

Further, as shown in FIG. 2 , it is a schematic diagram of the system architecture of webpage tamper-proofing proposed by the present application, which can be deployed in a service server. Specifically, a protection POD can be deployed on each container worker node first. One of the protection PODs is a node on the container dedicated to monitoring protection service parameters, and can be allocated certain computing and running resources.

It should be noted that the control center is responsible for managing all protection PODs, and uniformly monitors the tamper protection status and basic container information of all containers. The basic container information includes: container name, container node system name, container ID, image name, container startup parameters, container creation time, container running status, container port mapping information, container running start and end time, and uniformly configure protection policies.

Specifically, the protection policy is used to prohibit any object from modifying the parameters under each image directory. Therefore, it is ensured that each image directory storing service parameters will not affect the process of service processing because the parameters are maliciously modified.

Further, in this application, the management and control center can issue a protection policy to the protection POD, and the policy attributes: container image name, protection directory, the container running with this container image name by default, no process can modify the files in the protection directory, and can target the container image name. Protect the directory to set subdirectories and process whitelists;

Among them, this application can issue a protection policy from the protection POD to the kernel protection layer, the policy attributes: container image name, protection directory, the default kernel protection layer prevents any process from modifying the files in the protection directory, and subdirectories and processes can be set for the protection directory. whitelist.

Further, the application can also implement the following steps to achieve the purpose of preventing tampering to the web page after generating and prohibiting modification of the parameters under each image directory:

first:

Automated policy orchestration can be achieved, including:

Automatic detection of container drift;

Automatically set container protection policies;

The policy is bound to the container image name, the containers in all container nodes running with the same image name will be protected, and the image name supports the * wildcard;

After the container is stopped and restarted, the tamper protection automatically takes effect;

The container is deleted and regenerated, and the tamper protection takes effect automatically

Second aspect:

Anti-tampering of web pages can be achieved, including:

After the directory inside a container image is protected, any directory inside the container created with the image will be protected. Container tampering protection that supports aufs, overlay2, and container file storage driver formats.

All directories and files (including subdirectories and files) under the directory cannot be modified. The policy image name supports the wildcard character *, and supports only logging without blocking tampering mode.

The third aspect:

New rules can be implemented, including:

Rule name: custom rule name;

Protection object: the directory to be protected, supports selecting the directory or pasting the path, supports wildcard input, but only one "*" exists in a directory, such as /a/*b/ is correct, but /a/*b* a/ is wrong, and the wildcard configuration for a folder must end with "/", if it is a file, it does not need to end with "/"

Allowed IP to be rewritten: Allows to rewrite the IP of the object, supports filling in a single IP, or multiple IPs separated by ",", does not support filling in the IP segment. Fill in * if all IP rewriting is allowed;

Process allowed to be rewritten: The process that is allowed to rewrite the object can be selected in the system, and the process name will be directly filled in. Fill in * if all processes are allowed to be rewritten;

Users allowed to overwrite: Select the users who are allowed to overwrite this object from the drop-down list. Select * to allow all users to rewrite;

Processing method: choose to record only or block and record;

Whether to enable: Select whether to enable the rule.

For added rules, you can disable/enable, re-edit, delete or add sub-rules.

Among them, for new sub-rules, it can include:

Protected Objects: Select or paste the subdirectories of protected objects in the rule;

Allowed IP to be rewritten: Allows to rewrite the IP of the object. It supports filling in a single IP, or multiple IPs are separated by ",", and does not support filling in the IP segment. Fill in * if all IP rewriting is allowed;

Process allowed to be rewritten: The process that is allowed to rewrite the object can be selected in the system, and the process name will be directly filled in. Fill in * if all processes are allowed to be rewritten;

Users allowed to overwrite: Select the users who are allowed to overwrite this object from the drop-down list. Select * to allow all users to rewrite;

Processing method: choose to record only or block and record;

Whether to enable: Select whether to enable the rule.

Fourth aspect:

Anti-attack modules can be implemented, including:

Implemented by the third-party security plug-in mechanism of the web container, all request context information can be obtained before the web background program processes the request, and it can be filtered in advance, and malicious requests can be intercepted in time. Website vulnerability protection, real-time protection against common website SQL injection attacks, XSS cross-site, Web container and application vulnerabilities. Each rule has a separate switch. After the website vulnerability protection is turned on, all other rules are turned on by default except "Automatically Block Scanners".

Fifth aspect:

Container monitoring can be implemented, including:

Displays containers running on all container nodes, including container name, image name, container ID, creation time, container running status, and tamper protection status.

Sixth aspect:

Orchestration system integration can be achieved, including:

Integrated with the orchestration system, the first deployment supports automatic installation of protection PODs on all container nodes managed by the orchestration system. When a container node is added or deleted, the protection POD of the corresponding node is automatically installed and uninstalled, which is compatible with K8S and Mesos.

In this application, multiple service PODs and protection PODs may be deployed on the container node of the service server, where the container node is a virtual system deployed in the service server, the service POD is used for service processing, and the protection POD is used for monitoring Tamper protection status; real-time detection of running parameters of each container node, running parameters include container node name, image name, container node ID, creation time, container node running status and tamper protection status; obtain all image directories saved in container nodes, And generate a protection policy that prohibits modification of parameters under each mirror directory, where each mirror directory corresponds to a worker node. By applying the technical solution of the present application, it is possible to realize the kernel protection of the container running under the name of each container image through the protection strategy, and the default kernel protection layer prevents any process from modifying the files in the protection directory, thereby realizing targeted protection of the files in the business directory. parameter. Thus, the problem that the existing anti-tampering technology cannot identify and protect the files inside the container node due to resource isolation of the virtual system in the server is avoided.

Optionally, in another embodiment based on the above method of the present application, before deploying multiple service PODs and protection PODs on the container nodes of the service server, the method further includes:

Establish a connection with the client through the protection POD;

Create a management control center, and use the management control center to manage the protection POD. The management includes displaying the tamper protection status of the container node and basic information of the container node. The basic information of the container node includes the name of the container node, the container node System name, container node ID, image name, container node startup parameters, container node creation time, container node running status, container node port mapping information, container node running start and end time.

Optionally, in another embodiment based on the above method of the present application, the managing the protection POD by using the management control center includes:

Send the protection policy to the protection POD using the management control center, and,

The protection policy is sent to the service POD using the protection POD.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

The protection policy is used to instruct the kernel protection layer of the container node to prevent any process from modifying any parameter under the image directory, where the parameter includes subdirectories and service parameters under the image directory.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

Determine the business server ID where each container node is located;

When it is detected that the ID of the service server where the container node is located is changed, a container node offset message is generated, and the container node offset message is sent to the management control center.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

Get the received service request message;

Malicious field detection is performed on the service request message, and if it is determined that the service request message has a malicious field, the service request message is intercepted.

Optionally, in another embodiment based on the above method of the present application, after the generating a protection policy that prohibits modification of parameters under each image directory, the method further includes:

If it is detected that a new container node exists in the service server, install and deploy the corresponding protection POD on the newly added container node; or,

If it is detected that the service server executes the container node deletion instruction, the protection POD on the container node deletion is uninstalled.

By applying the technical solution of the present application, it is possible to realize the kernel protection of the container running under the name of each container image through the protection strategy, and the default kernel protection layer prevents any process from modifying the files in the protection directory, thereby realizing targeted protection of the files in the business directory. parameter. Thus, the problem that the existing anti-tampering technology cannot identify and protect the files inside the container node due to resource isolation of the virtual system in the server is avoided.

Optionally, in another implementation manner of the present application, as shown in FIG. 3 , the present application further provides a system for preventing tampering of a webpage. These include:

The deployment module 201 is configured to deploy multiple service PODs and protection PODs on container nodes of the service server, where the container nodes are virtual systems deployed in the service servers, and the service PODs are used for service processing , the protection POD is used to monitor the tamper protection status;

The detection module 202 is configured to detect the running parameters of each container node in real time, and the running parameters include the container node name, image name, container node ID, creation time, container node running status and tamper protection status;

The generating module 203 is configured to acquire all image directories stored in the container node, and generate a protection policy forbidding modification of parameters under each image directory, wherein each image directory corresponds to a working node.

In this application, multiple service PODs and protection PODs may be deployed on the container node of the service server, where the container node is a virtual system deployed in the service server, the service POD is used for service processing, and the protection POD is used for monitoring Tamper protection status; real-time detection of running parameters of each container node, running parameters include container node name, image name, container node ID, creation time, container node running status and tamper protection status; obtain all image directories saved in container nodes, And generate a protection policy that prohibits modification of parameters under each mirror directory, where each mirror directory corresponds to a worker node. By applying the technical solution of the present application, it is possible to realize the kernel protection of the container running under the name of each container image through the protection strategy, and the default kernel protection layer prevents any process from modifying the files in the protection directory, thereby realizing targeted protection of the files in the business directory. parameter. Thus, the problem that the existing anti-tampering technology cannot identify and protect the files inside the container node due to resource isolation of the virtual system in the server is avoided.

In another embodiment of the present application, the steps configured to execute the deployment module 201 include:

Establish a connection with the client through the protection POD;

Create a management control center, and use the management control center to manage the protection POD. The management includes displaying the tamper protection status of the container node and basic information of the container node. The basic information of the container node includes the name of the container node, the container node System name, container node ID, image name, container node startup parameters, container node creation time, container node running status, container node port mapping information, container node running start and end time.

In another embodiment of the present application, the steps configured to execute the deployment module 201 include:

Send the protection policy to the protection POD using the management control center, and,

The protection policy is sent to the service POD using the protection POD.

In another embodiment of the present application, the steps configured to execute the deployment module 201 include:

The protection policy is used to instruct the kernel protection layer of the container node to prevent any process from modifying any parameters in the image directory, where the parameters include subdirectories and service parameters in the image directory.

In another embodiment of the present application, the steps configured to execute the deployment module 201 include:

Determine the business server ID where each container node is located;

When it is detected that the ID of the service server where the container node is located is changed, a container node offset message is generated, and the container node offset message is sent to the management control center.

In another embodiment of the present application, the steps configured to execute the deployment module 201 include:

Get the received service request message;

Malicious field detection is performed on the service request message, and if it is determined that the service request message has a malicious field, the service request message is intercepted.

In another embodiment of the present application, the steps configured to execute the deployment module 201 include:

If it is detected that a new container node exists in the service server, install and deploy the corresponding protection POD on the newly added container node; or,

If it is detected that an instruction to delete a container node is executed in the service server, the protection POD on the container node for deletion is uninstalled.

Fig. 4 is a logical structural block diagram of an electronic device according to an exemplary embodiment. For example, electronic device 300 may be a mobile phone, computer, digital broadcast terminal, messaging device, game console, tablet device, medical device, fitness device, personal digital assistant, and the like.

In an exemplary embodiment, there is also provided a non-transitory computer-readable storage medium including instructions, such as a memory including instructions, the instructions can be executed by an electronic device processor to complete the above-mentioned method for preventing tampering of a webpage, the method comprising: : When multiple service PODs and protection PODs are deployed on the container node of the service server, the container node is a virtual system deployed in the service server, the service POD is used for service processing, and the protection POD Used to monitor tamper protection status;

Detecting the running parameters of each container node in real time, the running parameters include the container node name, image name, container node ID, creation time, container node running status and tamper protection status;

Acquire all image directories stored in the container node, and generate a protection policy that prohibits modification of parameters under each image directory, wherein each image directory corresponds to a working node. Optionally, the above-mentioned instructions may also be executed by the processor of the electronic device to complete other steps involved in the above-mentioned exemplary embodiments. For example, the non-transitory computer-readable storage medium may be ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.

In an exemplary embodiment, an application program/computer program product is also provided, which includes one or more instructions, and the one or more instructions can be executed by a processor of an electronic device to complete the above-mentioned method for preventing tampering of a webpage, The method includes: deploying a plurality of service PODs and protection PODs on a container node of the service server, where the container node is a virtual system deployed in the service server, the service PODs are used for service processing, and the The protection POD is used to monitor the tamper protection status;

Detecting the running parameters of each container node in real time, the running parameters include the container node name, image name, container node ID, creation time, container node running status and tamper protection status;

Acquire all image directories stored in the container node, and generate a protection policy that prohibits modification of parameters under each image directory, wherein each image directory corresponds to a working node. Optionally, the above-mentioned instructions may also be executed by the processor of the electronic device to complete other steps involved in the above-mentioned exemplary embodiments.

Those skilled in the art can understand that the schematic diagram 4 is only an example of the electronic device 300, and does not constitute a limitation to the electronic device 300, and may include more or less components than the one shown, or combine some components, or different components For example, the electronic device 300 may further include an input and output device, a network access device, a bus, and the like.

The so-called processor 302 may be a central processing unit (Central Processing Unit, CPU), and may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor 302 can also be any conventional processor, etc. The processor 302 is the control center of the electronic device 300, and uses various interfaces and lines to connect various parts of the entire electronic device 300.

The memory 301 can be used to store computer-readable instructions, and the processor 302 implements various functions of the electronic device 300 by running or executing the computer-readable instructions or modules stored in the memory 301 and calling data stored in the memory 301 . The memory 301 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program (such as a sound playback function, an image playback function, etc.) required for at least one function, and the like; Data created by the use of the electronic device 300, and the like. In addition, the memory 301 may include a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card (Flash Card), at least one disk storage device, a flash memory device, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM) or other non-volatile/volatile storage devices.

If the modules integrated in the electronic device 300 are implemented in the form of software functional modules and sold or used as independent products, they may be stored in a computer-readable storage medium. Based on this understanding, the present application realizes all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium, The computer-readable instructions, when executed by the processor, can implement the steps of the above-mentioned various method embodiments.

Other embodiments of the present application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of this application that follow the general principles of this application and include common knowledge or conventional techniques in the technical field not disclosed in this application . The specification and examples are to be regarded as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

It is to be understood that the present application is not limited to the precise structures described above and illustrated in the accompanying drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims (10)

1. A method for preventing webpage from being tampered is applied to a business server and comprises the following steps:

deploying a plurality of service PODs and protection PODs on a container node of the service server, wherein the container node is a virtual system deployed in the service server, the service PODs are used for performing service processing, and the protection PODs are used for monitoring tampering protection states;

detecting the operation parameters of each container node in real time, wherein the operation parameters comprise the name of the container node, the name of a mirror image, the ID of the container node, the creation time, the operation state of the container node and the tamper protection state;

and acquiring all mirror image catalogues stored in the container node, and generating a protection strategy for forbidding to modify parameters under each mirror image catalog, wherein each mirror image catalog corresponds to a working node.

2. The method of claim 1, wherein prior to deploying a plurality of service PODs and guard PODs on a container node of the service server, further comprising:

establishing a connection with a client through the protection POD;

creating a management control center, and managing the protection POD by using the management control center, wherein the management comprises displaying the tampering protection state of the container node and the basic information of the container node, and the basic information of the container node comprises the name of the container node, the system name of the container node, the ID of the container node, the mirror image name, the starting parameter of the container node, the creation time of the container node, the operation state of the container node, the port mapping information of the container node and the operation starting and ending time of the container node.

3. The method of claim 2, wherein said managing said protected PODs with said management control center comprises:

sending, with the management control center, the protection policy to a protection POD, and,

and sending the protection strategy to the service POD by using the protection POD.

4. The method of claim 1, wherein after generating the protection policy that prohibits modification of parameters under each image catalog, further comprising:

and utilizing the protection strategy to instruct a kernel protection layer of the container node to prevent any process from modifying any parameter under the mirror directory, wherein the parameter comprises a subdirectory under the mirror directory and a service parameter.

5. The method of claim 1, wherein after generating the protection policy that prohibits modification of parameters under each image catalog, further comprising:

determining the ID of a service server where each container node is located;

and when the ID of the service server where the container node is located is detected to be changed, generating a container node offset message, and sending the container node offset message to a management control center.

6. The method of claim 1, wherein after generating the protection policy that prohibits modification of parameters under each image catalog, further comprising:

acquiring a received service request message;

and detecting malicious fields of the service request message, and if the service request message is determined to have the malicious fields, intercepting the service request message.

7. The method of claim 1, wherein after generating the protection policy that prohibits modification of parameters under each image catalog, further comprising:

if detecting that a new container node exists in the service server, installing and deploying a corresponding protection POD on the new container node; or the like, or, alternatively,

and if detecting that the instruction for deleting the container node is executed in the service server, unloading the protective POD on the container node.

8. A system for preventing webpage tampering is applied to a business server and comprises the following components:

a deployment module configured to deploy a plurality of service PODs and protection PODs on a container node of the service server, where the container node is a virtual system deployed in the service server, the service PODs are used for performing service processing, and the protection PODs are used for monitoring a tamper protection state;

the detection module is configured to detect the operation parameters of each container node in real time, wherein the operation parameters comprise the name of the container node, the name of a mirror image, the ID of the container node, the creation time, the operation state of the container node and the tamper protection state;

and the generating module is configured to acquire all the mirror image catalogues stored in the container node and generate a protection strategy for forbidding to modify parameters under each mirror image catalog, wherein each mirror image catalog corresponds to one working node.

9. An electronic device, comprising:

a memory for storing executable instructions; and the number of the first and second groups,

a processor for executing the executable instructions with the memory to perform the operations of the method of tamper-proofing a web page of any of claims 1-7.

10. A computer-readable storage medium storing computer-readable instructions, wherein the instructions, when executed, perform the operations of the method for webpage tamper resistance of any of claims 1-7.

Images