SDN-based SDP security group implementation method and security system

Abstract

The invention discloses an SDN-based SDP security group implementation method and a security system, and the method achieves SPA single-packet authorization service logic through adoption of a flow table method of an SDN network, and carries out the planning and identity authentication of access authorities of different users through combining with the IAM user management of a cloud platform. According to the invention, the security of the cloud platform security group function is enhanced; accurate control of the security group on external authorization is realized; in combination with the identity authentication technology of the cloud platform and the SDN cloud network, the additional cost of the SDP gateway and the SDP controller is reduced, the SDP technology and the cloud computing security technology are fused, meanwhile, attacks from an internal network can be effectively defended, and comprehensive defense of flow in all directions of the cloud platform can be achieved.

Description

technical field [0001] The invention belongs to the technical field of software-defined boundaries, and in particular relates to an SDN-based SDP security group realization method and a security system. Background technique [0002] The software-defined perimeter (SDP) is a security framework developed by the Cloud Security Alliance (CSA) that controls access to resources based on identity. Each terminal must perform unicast authorization (SPA) verification before connecting to the server to ensure that each device is allowed to access. Its core idea is to hide core network assets and facilities through the SDP architecture, so that they are not directly exposed to the Internet, so that network assets and facilities are protected from external security threats. Due to the large scope of protected services, the traditional SDP architecture generally adopts the gateway mode, such as figure 1 Shown: The access rules established by the SDP controller are only open to authorize...

AI Technical Summary

Problems solved by technology

[0004] 1. Due to the strong mobility of the client, the IP address often changes, so the security group needs to authorize the whitelist of a wide range of IP network segments to open port access. This method makes the server easy to be scanned by hackers and discover services The external port, thus launching destructive attacks, brute force cracking and other attack behaviors

[0005] 2. The traditional SDP software-defined boundary architecture needs to be realized through the SDP gateway and the SDP controller. The SDP gateway needs to have a virtual machine or a physical machine as a carrier, which brings a certain increase in cost and management complexity, and the SDP gateway has a single The problem of limited point load capacity makes it difficult to effectively integrate with the existing security management system of the cloud platform

[0006] 3. The traditional SDP software-defined boundary security is mainly aimed at the boundary security of the external network to the internal network, and for the internal network protection between multi-tenants in the cloud platform. In the same host, SDP security protection between different virtual machines, traditional SDP Software-defined boundary security architecture is difficult to meet

Images