Micro Segmentation Design of Power System Container

Micro Segmentation implements access control between microservices in a fine-grained way, but the rule configuration in actual deployment is extremely cumbersome. Efficiently implementing micro Segmentation of networks, processes, and files in container environments can clear a major obstacle to achieving information security in the power system. An effective way to solve this problem is to adopt the container business working mode of “training-alarm-protection”, that is, to monitor network traffic in the training mode, conduct deep packet inspection (DPI) analysis, and then automatically generate network, process, file access rules and white list; In the alarm mode, supplement and improve the rules according to the alarm information during operation; In the protection mode, the business is officially launched. The Fanotify mechanism is used to monitor network traffic and block the captured operations that are not in the white list rules, so as to achieve Micro Segmentation of container networks, processes, and files. The experiment shows that the operation under the three modes of training, alarm and protection all meet the design expectations, which provides an efficient and feasible method for realizing the Micro Segmentation of containers.