Network micro-isolation strategy self-generation method and system

Abstract

The invention relates to a network micro-isolation strategy self-generation method and system. The method comprises the following steps: S1, selecting an existing strategy set or a new strategy set, judging whether the strategy range in the strategy set has an access relation, and if yes, classifying the data in the strategy set by taking the type of the access relation as the dimension, the number of access relations corresponding to different access relation types is counted, and then the rule coverage rate of each access relation type is calculated; s2, performing corresponding strategy rule configuration on the data of each access relation type according to the access relation type; s3, verifying the configured strategy rule, and entering S4 when the verification is passed; otherwise, returning to S2 to perform strategy rule configuration again; and S4, after the cloud issues the verified strategy rule to the working load end, the working load end performs corresponding configuration according to the configuration item of the strategy rule after receiving the strategy rule. According to the method, the strategy rules can be quickly and conveniently generated in batches, and the complexity of manual carding of a user is reduced.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and system for self-generating network micro-isolation policies. Background technique [0002] Micro-segmentation is a fine-grained network isolation technology. It divides the network and cloud into smaller areas, which can meet the needs of traffic isolation in different environments. Its core functional requirements are to focus on the isolation of east-west traffic, focusing on preventing Lateral movement of attackers once inside the data center. Traditional firewalls are isolated on single-point boundaries, while micro-isolation extends the segmentation capability to cloud workloads and containers, adopts the method of separating the control center platform from the policy execution unit, and has the characteristics of distribution and self-adaptation, which is different from The isolation function of the firewall is also a real requirement in the cloud computing en...

AI Technical Summary

Problems solved by technology

[0003] With the rise of cloud computing, business migration to the cloud has become a trend. The changes in the data center environment have brought many challenges to the network security of the data center, such as: the east-west access traffic is huge, and the access relationship between services cannot be perceived; Formulate fine-grained access control policies, static policies cannot follow the automatic migration of virtual machines and other network access border inspection control issues

[0004] The current mainstream technical solutions mainly divide the rule dimension level from the two dimensions of the visitor and the accessed service. The granularity of the rule dimension division is not fine enough, and the generated rules cannot accurately control the communication between workload nodes.

And it is impossible to add targeted policy rules for abnormal access relationships, and does not support the type of custom configuration policy rules

Using VLAN technology, VxLAN technology, and VPC technology cannot solve the isolation strategy between virtualized devices, containers, host workloads, and business applications.

From the perspective of technical characteristics, VLAN is a coarse-grained network isolation technology. VxLAN and VPC are closer to the technical requirements of micro-isolation, but they are not very good at solving the direct isolation problems between hosts and hosts and between hosts and containers.

Images