Security service function chain design method and system based on software defined security

Abstract

The invention provides a security service function chain design method and system based on software defined security. The method comprises the following steps: acquiring a user security service demand; constructing a security service chain strategy according to a user security service demand; selecting a passing virtual security device for the security service chain, and performing mapping from a logic data packet to a physical forwarding path; and analyzing to obtain the flow instruction, and performing flow redirection operation in a flow table issuing mode. A security service function chain is constructed according to user requirements, security resource scheduling is realized according to the load condition of a host machine, and a security service function chain rule classifies network flows in an OpenFlow flow table mode and sequentially redirects the network flows to corresponding security equipment, so dynamic control of the network flows is realized. Tests show that the mechanism can effectively realize security service virtualization, and a flexible and dynamic security protection mechanism is provided according to security service requirements.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method and system for designing a security service function chain based on software-defined security. Background technique [0002] The service chain (SC) of the traditional network pulls the network data flow satisfying specific attributes through a service sequence composed of multiple business function service nodes, which provides traditional networks with means of preventing and controlling malicious attacks. The software-defined security (Software Defined Security, SDS) architecture decouples the control plane and data plane of network security devices. The bottom layer is abstracted as resources in the security resource pool, and the top layer implements flexibility by elastically orchestrating security services in a software-defined manner. safety protection. [0003] However, with the rapid development of cloud computing and software-defined network (Software Defin...

AI Technical Summary

Problems solved by technology

[0004] Therefore, the technical problem to be solved by the present invention is to overcome the defects in the prior art that it is difficult to improve the flexibility and efficiency of network security protection, thereby providing a security service function chain design method and system based on software-defined security

Images