Secure resource pool realization method and secure resource pool system

Abstract

The embodiment of the invention provides a secure resource pool realization method and a secure resource pool system and is used for improving the adaptability of a secure resource pool for network change and configuration flexibility of the secure resource pool. According to the embodiment of the invention, a network docking device and a first virtual switch which are independent are set in the secure resource pool. The network docking device realizes a function of independently docking with a user side network. The first virtual switch independently realizes a secure service link distribution function. Network docking and a secure resource pool service link distribution policy function are decoupled. The adaptability of the secure resource pool for the network change is improved. Multi-dimensional configuration can be carried out on a distribution policy in a secure service link based on at least two matching domain fields, so the configuration flexibility of the secure resource poolis improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for realizing a security resource pool. Background technique [0002] The security resource pool is a collection of physical or virtual security function components. The functions of the security function components may include firewall, VPN, load balancing, WAN acceleration, Internet behavior control, bastion host, intrusion detection / defense, etc. As the concept of security resource pools is recognized by more and more users, the deployment cases of security resource pools are gradually increasing. During the deployment of security resource pools, the drainage of security resource pools is the key. [0003] At present, the main drainage methods of security resource pools (as shown in the attached figure 1 shown) is to divert traffic through policy routing, wherein, for north-south traffic, the traffic is directed to the security resource pool throu...

AI Technical Summary

Problems solved by technology

[0004] The drainage method of the security resource pool in the existing solution mainly has the following disadvantages: on the side of the security resource pool, because the network connection function and the drainage policy function of the security resource pool service chain are all realized through the security resource pool routing gateway Therefore, the network docking part of the security resource pool drainage method is closely coupled with the security service chain drainage. When the user's network scene changes and the network docking part needs to be changed, the security service chain must be redeployed according to the change of the network docking part. To meet the drainage needs in new scenarios, the adaptability to network changes is poor. Secondly, policy routing is often the destination address routing or source address to configure the drainage strategy in one dimension, and the strategy of gateway drainage is not flexible.

Images