Network security function joint configuration method and system based on maximum satisfiability model theory

Abstract

The method and system for joint configuration of network security functions based on the maximum satisfiability modulo theory include the following steps: (1) Problem modeling process: modeling the joint configuration problem of network security functions as a maximum satisfiability modulo theory MaxSMT problem; (2) Hard constraint generation process; (3) Soft constraint generation process; (4) MaxSMT solution process; (5) Result extraction process: extracting the joint configuration results of network security functions from the model output by the solver; The method and system of the present invention can automatically determine the optimal deployment location, configuration rules and execution order of various network security functions in the network, significantly reduce the configuration complexity and improve the intelligence level of network security configuration while strictly meeting all security requirements.

Description

Technical Field

[0001] This invention relates to a method and system for joint configuration of network security functions based on the maximum satisfiability modulus theory, belonging to the field of information technology, and particularly to the field of joint configuration technology of network security functions. Background Technology

[0002] New virtualization technology paradigms such as Network Functions Virtualization (NFV) and Software-Defined Networking (SDN) have significantly improved network flexibility and agility, providing strong support for network security configuration optimization. Specifically, the application of intent-based technologies makes it possible to build virtual function configuration systems automatically. These systems can effectively enforce various security attributes, including but not limited to key security indicators such as connectivity requirements, authentication, and data confidentiality.

[0003] In existing technologies, automated security configuration tools are gradually replacing traditional manual intervention methods. The reason for this is that the complexity of modern network architectures is constantly increasing. Manual security configuration is not only prone to operational errors, but also suffers from low configuration efficiency due to the expansion of network scale and the complexity of logical relationships. It is difficult to meet the real-time and accuracy requirements of modern networks for security configuration, and traditional manual intervention methods are gradually becoming unsuitable for real-world application scenarios.

[0004] Most existing automation solutions focus on the configuration of specific security scenarios, such as configuring distributed firewalls to implement security intents of mandatory isolation and reachability, or configuring channel protection systems to implement security intents of data confidentiality and integrity. These methods are very effective in single-type intent scenarios. By refining intents and eliminating conflicts, effective intents are converted into formal constraints that can be understood by the SMT solver, and NSF deployment and configuration schemes with correct guarantees are solved.

[0005] As networks continue to expand and cyberattacks become increasingly sophisticated, single security functions are no longer sufficient to meet the diverse security needs of modern networks. In practical network deployments, it is typically necessary to deploy multiple types of network security functions, such as firewalls, tunneling protection systems, and intrusion detection systems, together to achieve comprehensive security protection. However, existing security function configuration methods have significant shortcomings: firstly, there is a lack of a unified modeling method for the joint deployment of multiple security functions, making it difficult to achieve collaborative planning and configuration of multiple security functions; secondly, when faced with diverse and multi-type security requirements, it is unable to accurately output the optimal solution for security function configuration.

[0006] One compromise is to configure different types of security functions in stages, with each stage employing existing automated configuration technologies. However, this approach lacks a holistic view of the automated system, resulting in ineffective coordination between different types of security functions. This leads to two major problems: firstly, the configuration results only provide a suboptimal solution to the intended input, failing to achieve optimal security protection; secondly, configuring security functions in later stages may cause previously configured security functions to become invalid, ultimately preventing the security intent from being realized and severely impacting the stability and reliability of network security protection.

[0007] To address the problems with existing technologies, there is a need for technologies capable of jointly configuring multiple types of network security functions to execute complex and diverse security intents. Currently, the following technical challenges are faced:

[0008] (1) Differences in configuration of different types of security functions: There are obvious differences in the functions and configuration operations of different types of security functions (such as firewalls and tunnel protection systems). Existing automation methods can usually only configure a single function type to meet specific security needs.

[0009] (2) Complex functional dependencies: There are complex dependencies between different security functions. For example, firewalls and IDS need to inspect the contents of data packets and can only process unencrypted data packets; while the channel protection system changes the encryption state of data packets, affecting the processing capabilities of other functions.

[0010] (3) Huge configuration space: In order to meet different types of security needs, the variables that need to be decided when implementing a complete deployment configuration scheme include: whether one or more different types of security functions are deployed on each edge, the rule configuration for enabling each security function, and the configuration space grows exponentially.

[0011] (4) Optimize conflicting objectives: Under the premise of meeting security requirements, it is necessary to optimize deployment cost (minimize the number of deployments) and configuration complexity (minimize the number of rules) at the same time. There are conflicts between these objectives.

[0012] How to solve the above problems has become a pressing technical challenge in the field of network security function joint configuration technology. Summary of the Invention

[0013] In view of this, the purpose of this invention is to invent a method and system that aims to solve the technical problems existing in the joint configuration of network security functions, such as unreasonable deployment locations, conflicting configuration rules, chaotic execution order, and high deployment costs and configuration complexity.

[0014] To achieve the above objectives, this invention proposes a joint configuration method for network security functions based on the maximum satisfiability modulus theory, the method comprising the following steps:

[0015] S101: Problem Modeling Process: The joint configuration problem of network security functions is modeled as a MaxSMT problem based on the maximum satisfiability modulus theory, specifically including the following input definitions and decision variable definitions:

[0016] Input definition:

[0017] Service Map ,in A network is a collection of nodes, including terminal nodes, routing nodes, server nodes, etc. This is the set of communication edges between nodes, and each edge... Corresponding to two nodes Communication links between them;

[0018] Access control policy set Each access control policy , Includes attribute types: reachability or isolation. Reachability indicates which traffic is allowed to access the site. Isolation means that traffic can be blocked. ;

[0019] Channel protection strategy set Each channel protection strategy includes a set of untrusted nodes and a set of inspection nodes; the communication traffic corresponding to untrusted nodes must be encrypted, and the communication traffic corresponding to inspection nodes must be inspected in plaintext.

[0020] Packet inspection strategy set Each packet inspection policy explicitly requires security checks and operation logging for traffic with specific characteristics;

[0021] Flow Atom Predicate Set Among them, the flow characteristic quintuple These represent the source / destination nodes, source / destination ports, and network protocols of the traffic, respectively.

[0022] Definition of decision variables:

[0023] Firewall variables: : indicates an edge Whether a firewall is deployed, among which Indicates deployment, Indicates no deployment; : indicates an edge The working modes of the firewall, among which Indicates whitelist mode. Indicates blacklist mode; : indicates an edge Is the flow in the set of atomic predicates AP? Configure explicit access rules, where Indicates configuration, This indicates that it is not configured.

[0024] : indicates an edge Does the firewall on the device block traffic? The transmission, in which To indicate refusal, This indicates permission.

[0025] CPS variables: : indicates an edge Whether or not the CPS (Channel Protection System) function is deployed, among which... Indicates deployment, Indicates no deployment;

[0026] : indicates an edge Does CPS affect traffic? Perform encryption operations, where Indicates that encryption will be performed. Indicates that the action will not be taken; : indicates an edge Does CPS affect traffic? Perform the decryption operation, where This indicates that decryption will be performed. Indicates that the action will not be taken; : indicates an edge Does it actually affect traffic? An encryption operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented; : indicates an edge Does it actually affect traffic? Decryption was performed, where Indicates actual execution. This indicates that it was not actually implemented.

[0027] IDS variables: : indicates an edge Whether to deploy an IDS (Intrusion Detection System) on the system, where Indicates deployment, Indicates no deployment; : indicates an edge Does the IDS on the network affect traffic? Perform the inspection operation, in which Indicates that an inspection will be performed. Indicates that the action will not be taken; : indicates an edge Does the IDS on the network affect traffic? Perform a recording operation, where Indicates execution record, Indicates that the action will not be taken; : indicates an edge Does it actually affect traffic? An inspection operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented; : indicates an edge Does it actually affect traffic? A recording operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented.

[0028] State variables: : Indicates flow rate On the side The encryption status on, where Indicates encryption status. Indicates plaintext status; : indicates an edge The execution order of various security functions is defined in six fixed complete sequence combinations, namely: This indicates the process of firewall → CPS → IDS. This indicates the process of firewall → IDS → CPS. This indicates CPS → Firewall → IDS. This indicates CPS→IDS→Firewall. This indicates IDS → Firewall → CPS. This indicates IDS → CPS → Firewall.

[0029] S102: Hard Constraint Generation Process: Hard constraints are mandatory conditions that must be met. They are the foundation for ensuring network security requirements and normal function operation, and specifically include the following hard constraints:

[0030] Firewall constraints:

[0031] For each edge and each flow The firewall's rejection logic is determined based on the valid encryption state of the traffic before the firewall executes its rules.

[0032] in, This indicates the effective encryption state of the traffic before the firewall executes, based on the edge. The execution order of security functions and the results of CPS operations are calculated as follows:

[0033] In the above formula, Indicates flow rate Reach the edge The previous edge we passed, This indicates the edge where the CPS performs the encryption operation; Normal rule logic satisfied

[0034] The encrypted default rules satisfy

[0035] CPS constraints:

[0036] CPS encryption and decryption operation functions are defined as follows:

[0037]

[0038] The encrypted state of the traffic propagates along the communication path, for each edge and each flow Its encryption state satisfies: If the edge It's traffic. The first edge on the communication path, then This means that the initial state of the traffic is plaintext.

[0039] CPS encryption and decryption operations are mutually exclusive, satisfying the following constraints:

[0040]

[0041] IDS constraints:

[0042] The IDS check and record operation functions are defined as follows:

[0043] in, This indicates the traffic before the IDS performs the inspection operation. The encryption state, according to the edge The execution order of security functions and the results of CPS operations are calculated.

[0044] IDS can only inspect unencrypted data packets, satisfying a hard constraint:

[0045] Access control policy constraints:

[0046] For each reachability access control policy There is at least one communication path. The This indicates that the demand has been met. The set of all communication paths such that all edges on the path allow traffic. transmission, Demand The corresponding traffic satisfies: ,in, Representing a path The set of all edges contained therein;

[0047] For each isolation access control policy All communication paths There must be at least one edge that rejects traffic. Transmission, satisfying:

[0048] Channel protection strategy constraints:

[0049] CPS protection strategy Each untrusted node , Representation strategy The set of untrusted nodes in the strategy Corresponding traffic Upon reaching the node Previously, encryption was required, and the encrypted data must be processed before reaching the node. Decryption operations must not be performed between them, satisfying the following condition:

[0050] in, Representing a path From the starting point to the node sub-paths, Representing a path From the middle To the node Subpaths;

[0051] For each inspection node , Representation strategy The set of check nodes in the data, if the traffic Upon reaching the node Since it has been encrypted before, it must be sent to the node. The previous decryption operation satisfied:

[0052] In CPS, encryption and decryption operations must exist in pairs, and the encryption operation must be performed before the decryption operation, satisfying the following conditions: in, Representing a path From the middle Sub-paths leading to the destination;

[0053] The communication path corresponding to traffic that has undergone CPS encryption or decryption must not be blocked by the firewall, satisfying the following:

[0054] Packet inspection strategy constraints:

[0055] For each packet inspection strategy There is at least one communication path. , Indicates satisfying the strategy The set of all communication paths, where at least one edge on each path has successfully checked unencrypted traffic. , Strategy The corresponding traffic satisfies:

[0056]

[0057] If the packet inspection policy q requires traffic logging, then the following must also be satisfied:

[0058]

[0059] S103: Soft Constraint Generation Process: Soft constraints are the optimization objectives, represented by a weighted maximum satisfiability form. Different weights are assigned to reflect the optimization priority.

[0060] Deployment optimization, highest priority: Aiming to minimize the number of network security functions deployed in the network, while satisfying: in, Given the highest weight, minimizing deployment costs is the primary optimization objective.

[0061] Configuration optimization, lowest priority: Aiming to minimize the number of configuration rules for network security functions, satisfying the following:

[0062] in, With the lowest weight, configuration complexity is further reduced while ensuring the minimum deployment cost;

[0063] S104: MaxSMT Solution Process: The MaxSMT problem established above is solved using the Optimize mode of the Z3 SMT solver. The specific process is as follows:

[0064] Add all the hard constraints generated in step S102 to the Z3 SMT solver;

[0065] All soft constraints generated in step S103 are added to the Z3 SMT solver in a weighted manner;

[0066] Call the solver's check() method to solve;

[0067] If the solution is successful, the model output by the solver is obtained; if the solution fails, no solution is returned, indicating that the optimization objective cannot be achieved while satisfying all hard constraints.

[0068] S105: Result Extraction Process: Extract the joint configuration results of network security functions from the model output by the solver, specifically including:

[0069] Firewall configuration information on each edge e, including firewall deployment status. Work mode and a list of explicit rules for each type of traffic ( );

[0070] CPS configuration information on each edge e, including CPS deployment status ( ) and a list of encryption / decryption rules for each type of traffic ( , );

[0071] IDS configuration information on each edge e, including IDS deployment status ( ) and a list of inspection / logging rules for each type of traffic ( , );

[0072] If the node deployed on edge e is a multi-functional node (i.e., deploying multiple security functions simultaneously), then the execution order of the security functions on that edge will be used to determine the security function execution order. The deployment location and execution process of each security function in the composite node are clearly defined; the composite function node refers to a node that deploys multiple security functions simultaneously.

[0073] This invention also proposes a network security function joint configuration system based on the maximum satisfiability modulus theory, which includes the following modules:

[0074] Input Module: This module is used to obtain the input data required for the joint configuration of network security functions, including the service graph G=(V,E), access control policy set, CPS protection policy set, packet inspection policy set, and traffic atomic predicate set, and to perform format validation and standardization processing on the input data to ensure the integrity and validity of the data;

[0075] Modeling Module: Connected to the input module, this module is used to model the joint configuration problem of network security functions as a MaxSMT problem, including defining decision variables based on input data, namely: firewall variables, CPS variables, IDS variables and state variables, and generating corresponding variable identifiers and value range descriptions;

[0076] Constraint Generation Module: Connected to the modeling module, it consists of hard constraint generation units and soft constraint generation units.

[0077] Hard constraint generation unit: This unit is used to generate constraints such as firewall constraints, CPS constraints, IDS constraints, access control policy constraints, CPS protection policy constraints, and packet inspection policy constraints based on the decision variables and input data defined by the modeling module, and convert all hard constraints into logical expression formats that can be recognized by the Z3 SMT solver.

[0078] Soft constraint generation unit: This unit is used to generate soft constraint conditions corresponding to deployment optimization and configuration optimization according to the optimization objective, assign weights to each soft constraint, and convert them into a weighted logical expression format that can be recognized by the Z3 SMT solver.

[0079] Solver Module: Connected to the constraint generation module, with a built-in Z3 SMT solver. This module is used to receive the hard constraint logic expression and soft constraint weighted logic expression output by the constraint generation module, call the optimization mode of the Z3 SMT solver to solve the problem, and output the solution result, i.e., whether the solution is successful or not, and the corresponding model when the solution is successful.

[0080] Result Extraction Module: Connected to the Solver Module, this module extracts firewall configuration information, CPS configuration information, IDS configuration information, and execution order and deployment location information of composite security function nodes from the model when the Solver Module outputs a successful solution. It also organizes the extracted configuration results into a standardized configuration report, including text descriptions and tables. When the Solver Module outputs a failed solution, it generates a no-solution warning report.

[0081] Output module: Connected to the result extraction module, this module is used to output the configuration report or unsolvable prompt report generated by the result extraction module to the user in a visual manner (such as screen display, file export), so that the user can perform actual deployment and configuration of network security functions based on the configuration report.

[0082] The beneficial effects of this invention are that it can automatically determine the optimal deployment location, configuration rules and execution order of various network security functions in the network, significantly reduce deployment costs and configuration complexity while strictly meeting all security requirements, improve the automation and intelligence level of network security configuration, and have good flexibility and scalability. Attached Figure Description

[0084] Figure 1 This is a flowchart of the network security function joint configuration method based on the maximum satisfiability modulus theory proposed in this invention.

[0085] Figure 2 This is a schematic diagram of the network topology of an example network in an embodiment of the present invention.

[0086] Figure 3 This is a schematic diagram of the module structure of the network security function joint configuration system based on the maximum satisfiability modulus proposed in this invention. Detailed Implementation

[0088] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings.

[0089] See Figure 1 This invention introduces a network security function joint configuration method based on the maximum satisfiability modulus theory, which includes the following steps:

[0090] S101: Problem Modeling Process: The joint configuration problem of network security functions is modeled as a MaxSMT problem based on the maximum satisfiability modulus theory, specifically including the following input definitions and decision variable definitions:

[0091] Input definition:

[0092] Service Map ,in A network is a collection of nodes, including terminal nodes, routing nodes, server nodes, etc. This is the set of communication edges between nodes, and each edge... Corresponding to two nodes Communication links between them;

[0093] Access control policy set Each access control policy , Includes attribute types: reachability or isolation. Reachability indicates which traffic is allowed to access the site. Isolation means that traffic can be blocked. ;

[0094] Channel protection strategy set Each channel protection strategy includes a set of untrusted nodes and a set of inspection nodes; the communication traffic corresponding to untrusted nodes must be encrypted, and the communication traffic corresponding to inspection nodes must be inspected in plaintext.

[0095] Packet inspection strategy set Each packet inspection policy explicitly requires security checks and operation logging for traffic with specific characteristics;

[0096] Flow Atom Predicate Set Among them, the flow characteristic quintuple These represent the source / destination nodes, source / destination ports, and network protocols of the traffic, respectively.

[0097] Definition of decision variables:

[0098] Firewall variables:

[0099] : indicates an edge Whether a firewall is deployed, among which Indicates deployment, Indicates no deployment;

[0100] : indicates an edge The working modes of the firewall, among which Indicates whitelist mode. Indicates blacklist mode;

[0101] : indicates an edge Is the flow in the set of atomic predicates AP? Configure explicit access rules, where Indicates configuration, This indicates that it is not configured.

[0102] : indicates an edge Does the firewall on the device block traffic? The transmission, in which To indicate refusal, This indicates permission.

[0103] CPS variables:

[0104] : indicates an edge Whether or not the CPS (Channel Protection System) function is deployed, among which... Indicates deployment, Indicates no deployment;

[0105] : indicates an edge Does CPS affect traffic? Perform encryption operations, where Indicates that encryption will be performed. Indicates that the action will not be taken;

[0106] : indicates an edge Does CPS affect traffic? Perform the decryption operation, where This indicates that decryption will be performed. Indicates that the action will not be taken;

[0107] : indicates an edge Does it actually affect traffic? An encryption operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented;

[0108] : indicates an edge Does it actually affect traffic? Decryption was performed, where Indicates actual execution. This indicates that it was not actually implemented.

[0109] IDS variables:

[0110] : indicates an edge Whether to deploy an IDS (Intrusion Detection System) on the system, where Indicates deployment, Indicates no deployment;

[0111] : indicates an edge Does the IDS on the network affect traffic? Perform the inspection operation, in which Indicates that an inspection will be performed. Indicates that the action will not be taken;

[0112] : indicates an edge Does the IDS on the network affect traffic? Perform a recording operation, where Indicates execution record, Indicates that the action will not be taken;

[0113] : indicates an edge Does it actually affect traffic? An inspection operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented;

[0114] : indicates an edge Does it actually affect traffic? A recording operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented.

[0115] State variables:

[0116] : Indicates flow rate On the side The encryption status on, where Indicates encryption status. Indicates plaintext status;

[0117] : indicates an edge The execution order of various security functions is defined in six fixed complete sequence combinations, namely: This indicates the process of firewall -> CPS -> IDS. This indicates the process of firewall -> IDS -> CPS. This indicates CPS -> Firewall -> IDS. This indicates that CPS -> IDS -> Firewall. This indicates IDS -> Firewall -> CPS. This indicates that IDS → CPS → Firewall.

[0118] S102: Hard Constraint Generation Process: Hard constraints are mandatory conditions that must be met. They are the foundation for ensuring network security requirements and normal function operation, and specifically include the following hard constraints:

[0119] Firewall constraints:

[0120] For each edge and each flow The firewall's rejection logic is determined based on the valid encryption state of the traffic before the firewall executes its rules.

[0121] in, This indicates the effective encryption state of the traffic before the firewall executes, based on the edge. The execution order of security functions and the results of CPS operations are calculated as follows:

[0122] In the above formula, Indicates flow rate Reach the edge The previous edge we passed, This indicates the edge where the CPS performs the encryption operation;

[0123] Normal rule logic is satisfied:

[0124]

[0125] The encrypted default rules satisfy:

[0126]

[0127] CPS constraints:

[0128] CPS encryption and decryption operation functions are defined as follows:

[0129]

[0130] The encrypted state of the traffic propagates along the communication path, for each edge and each flow Its encryption state satisfies: If the edge It's traffic. The first edge on the communication path, then This means that the initial state of the traffic is plaintext.

[0131] CPS encryption and decryption operations are mutually exclusive, satisfying the following constraints:

[0132]

[0133] IDS constraints:

[0134] The IDS check and record operation functions are defined as follows:

[0135] in, This indicates the traffic before the IDS performs the inspection operation. The encryption state, according to the edge The execution order of security functions and the results of CPS operations are calculated.

[0136] IDS can only inspect unencrypted data packets, satisfying a hard constraint:

[0137]

[0138] Access control policy constraints:

[0139] For each reachability access control policy There is at least one communication path. The This indicates that the demand has been met. The set of all communication paths such that all edges on the path allow traffic. transmission, Demand The corresponding traffic satisfies: ,in, Representing a path The set of all edges contained therein;

[0140] For each isolation access control policy All communication paths There must be at least one edge that rejects traffic. Transmission, satisfying:

[0141] Channel protection strategy constraints:

[0142] CPS protection strategy Each untrusted node , Representation strategy The set of untrusted nodes in the strategy Corresponding traffic Upon reaching the node Previously, encryption was required, and the encrypted data must be processed before reaching the node. Decryption operations must not be performed between them, satisfying the following condition:

[0143] in, Representing a path From the starting point to the node sub-paths, Representing a path From the middle To the node Subpaths;

[0144] For each inspection node , Representation strategy The set of check nodes in the data, if the traffic Upon reaching the node Since it has been encrypted before, it must be sent to the node. The previous decryption operation satisfied:

[0145] In CPS, encryption and decryption operations must exist in pairs, and the encryption operation must be performed before the decryption operation, satisfying the following conditions: in, Representing a path From the middle Sub-paths leading to the destination;

[0146] The communication path corresponding to traffic that has undergone CPS encryption or decryption must not be blocked by the firewall, satisfying the following:

[0147] Packet inspection strategy constraints:

[0148] For each packet inspection strategy There is at least one communication path. , Indicates satisfying the strategy The set of all communication paths, where at least one edge on each path has successfully checked unencrypted traffic. , Strategy The corresponding traffic satisfies:

[0149]

[0150] If the packet inspection policy q requires traffic logging, then the following must also be satisfied:

[0151] S103: Soft Constraint Generation Process: Soft constraints are the optimization objectives, represented by a weighted maximum satisfiability form. Different weights are assigned to reflect the optimization priority.

[0152] Deployment optimization, highest priority: Aiming to minimize the number of network security functions deployed in the network, while satisfying: in, Given the highest weight, minimizing deployment costs is the primary optimization objective.

[0153] Configuration optimization, lowest priority: Aiming to minimize the number of configuration rules for network security functions, satisfying the following: in, With the lowest weight, configuration complexity is further reduced while ensuring the minimum deployment cost;

[0154] S104: MaxSMT Solution Process: The MaxSMT problem established above is solved using the Optimize mode of the Z3 SMT solver. The specific process is as follows:

[0155] Add all the hard constraints generated in step S102 to the Z3 SMT solver;

[0156] All soft constraints generated in step S103 are added to the Z3 SMT solver in a weighted manner;

[0157] Call the solver's check() method to solve;

[0158] If the solution is successful, the model output by the solver is obtained; if the solution fails, no solution is returned, indicating that the optimization objective cannot be achieved while satisfying all hard constraints.

[0159] S105: Result Extraction Process: Extract the joint configuration results of network security functions from the model output by the solver, specifically including:

[0160] Firewall configuration information on each edge e, including firewall deployment status. Work mode and a list of explicit rules for each type of traffic ( );

[0161] CPS configuration information on each edge e, including CPS deployment status ( ) and a list of encryption / decryption rules for each type of traffic ( , );

[0162] IDS configuration information on each edge e, including IDS deployment status ( ) and a list of inspection / logging rules for each type of traffic ( , );

[0163] If the node deployed on edge e is a multi-functional node (i.e., deploying multiple security functions simultaneously), then the execution order of the security functions on that edge will be used to determine the security function execution order. The deployment location and execution process of each security function in the composite node are clearly defined; the composite function node refers to a node that deploys multiple security functions simultaneously.

[0164] See Figure 2 The inventor Figure 2 Taking a network as an example, the aforementioned method will be illustrated below.

[0165] (1) Scenario setting for the implementation example:

[0166] Service map of the network In, node set ,in For terminal nodes, For routing nodes, For server nodes, For internal inspection nodes, For internal core server nodes; edge set , connect , connect , connect , connect , connect .

[0167] The other input data is as follows:

[0168] Security requirements set : For reachability requirements (source node) Target node The traffic characteristics are TCP protocol + port 8080. For isolation requirements (source node) Target node The traffic characteristics are UDP protocol + port 53).

[0169] CPS Protection Strategy Set : The set of untrusted nodes is The set of nodes to be checked is The corresponding traffic For all from Flow direction Traffic;

[0170] Check record strategy set : Requirement for from Flow direction The traffic of the TCP protocol and port 8080 is inspected and recorded, and the corresponding traffic is recorded. .

[0171] (2) Specific implementation methods and steps:

[0172] (2.1) Problem Modeling

[0173] 1. Input Definition: Define the input according to the service graph, security requirement set, CPS protection policy set and inspection log policy set set in the above scenario, and standardize the description of traffic characteristics (e.g., TCP protocol is identified as "TCP", port 8080 is identified as "8080").

[0174] 2. Definition of decision variables:

[0175] Firewall variables: for each edge and traffic ,definition , , , ;

[0176] CPS variables: for each edge and traffic ,definition , , , , ;

[0177] IDS variables: for each edge and traffic ,definition , , , , ;

[0178] State variables: for each edge And the corresponding traffic, define and (Values ​​are integers from 0 to 5).

[0179] (2.2) Generation of hard constraints

[0180] 1. Firewall constraints:

[0181] With the edge and traffic For example, if (Firewall -> CPS -> IDS), and CPS is not executed in front of the firewall, then

[0182] because yes The first edge, therefore The firewall executes normal rules;

[0183] Generate all edges and corresponding firewall rejection logic constraints based on the logical expressions of firewall constraints.

[0184] 2. CPS Constraints:

[0185] For the edge (connect and ) and traffic ,like and ,but ;

[0186] Based on the logical expression of the CPS constraint, constraints such as cryptographic state propagation and mutual exclusion are generated.

[0187] 3. IDS constraints:

[0188] For the edge (connect and ) and traffic ,like (CPS -> Firewall -> IDS), and if CPS has either not performed encryption or has performed decryption, then ,satisfy ;

[0189] Generate function constraints for IDS inspection and logging operations.

[0190] 4. Security requirements constraints:

[0191] for (Accessibility requirements), to be met ,in ;

[0192] for (Isolation requirements), to meet ,in .

[0193] 5. CPS protection strategy constraints:

[0194] for Untrusted nodes in ,satisfy

[0195]

[0196] For inspection nodes ,satisfy

[0197]

[0198] Generate encryption / decryption pairings and ensure paths are not rejected, among other constraints.

[0199] 6. Check record policy constraints:

[0200] for ,satisfy and ,in .

[0201] (2.3) Generating soft constraints

[0202] 1. Deployment optimization constraints: ;

[0203] 2. Configuration optimization constraints: .

[0204] (2.4) MaxSMT solution

[0205] Input all the hard constraint logic expressions and soft constraint weighted logic expressions generated above into the Z3 SMT solver, call the optimization mode to solve, and obtain the corresponding model after successful solution.

[0206] (2.5) Result Extraction and Output

[0207] The output from the Z3 solver is as follows (partial key results):

[0208] 1. Firewall configuration: (side Deploy a firewall). (Blacklist mode) (reject arrive UDP+53 traffic); other side firewalls ;

[0209] 2. CPS Configuration: (side Deploy CPS). (right (Outgoing traffic encrypted) (side Deploy CPS). (Decrypt before checking nodes); (side Deploy CPS). (Pairing and decryption); remaining edges ;

[0210] 3. IDS Configuration: (side Deploy IDS). , (right arrive (Check and record TCP+8080 traffic); other sides ;

[0211] 4. Execution order of functions for composite deployment nodes: (CPS → IDS → Firewall) (CPS → Firewall → IDS) (Firewall -> CPS -> IDS) (Firewall -> CPS -> IDS).

[0212] The result extraction module extracts the following deployment and configuration schemes representing all decision variables: On edge e2, deploy a firewall and a CPS in the order from v2 to v3. The firewall is set to blacklist mode, with explicit denial rules configured for traffic characteristics (source node v3, target node v5, UDP protocol + port 53). The CPS is configured to perform encryption operations for traffic characteristics (source node v3, target node v5). On edges e3 and e5, deploy a CPS, configuring it to perform decryption operations for traffic characteristics (source node v3, target node v5). On edge e4, deploy an IDS, configuring it to perform packet inspection and recording operations for traffic characteristics (source node v1, target node v5, TCP protocol + port 8080).

[0213] The output module outputs the above configuration results in the form of visual tables and text descriptions.

[0214] See Figure 3 This invention introduces a network security function joint configuration system based on the maximum satisfiability modulus theory, which is based on the aforementioned method. The system includes the following modules:

[0215] Input Module: This module is used to obtain the input data required for the joint configuration of network security functions, including the service graph G=(V,E), access control policy set, CPS protection policy set, packet inspection policy set, and traffic atomic predicate set, and to perform format validation and standardization processing on the input data to ensure the integrity and validity of the data;

[0216] Modeling Module: Connected to the input module, this module is used to model the joint configuration problem of network security functions as a MaxSMT problem, including defining decision variables based on input data, namely: firewall variables, CPS variables, IDS variables and state variables, and generating corresponding variable identifiers and value range descriptions;

[0217] Constraint Generation Module: Connected to the modeling module, it consists of hard constraint generation units and soft constraint generation units.

[0218] Hard constraint generation unit: This unit is used to generate constraints such as firewall constraints, CPS constraints, IDS constraints, access control policy constraints, CPS protection policy constraints, and packet inspection policy constraints based on the decision variables and input data defined by the modeling module, and convert all hard constraints into logical expression formats that can be recognized by the Z3 SMT solver.

[0219] Soft constraint generation unit: This unit is used to generate soft constraint conditions corresponding to deployment optimization and configuration optimization according to the optimization objective, assign weights to each soft constraint, and convert them into a weighted logical expression format that can be recognized by the Z3 SMT solver.

[0220] Solver Module: Connected to the constraint generation module, with a built-in Z3 SMT solver. This module is used to receive the hard constraint logic expression and soft constraint weighted logic expression output by the constraint generation module, call the optimization mode of the Z3 SMT solver to solve the problem, and output the solution result, i.e., whether the solution is successful or not, and the corresponding model when the solution is successful.

[0221] Result Extraction Module: Connected to the Solver Module, this module extracts firewall configuration information, CPS configuration information, IDS configuration information, and execution order and deployment location information of composite security function nodes from the model when the Solver Module outputs a successful solution. It also organizes the extracted configuration results into a standardized configuration report, including text descriptions and tables. When the Solver Module outputs a failed solution, it generates a no-solution warning report.

[0222] Output module: Connected to the result extraction module, this module is used to output the configuration report or unsolvable prompt report generated by the result extraction module to the user in a visual manner (such as screen display, file export), so that the user can perform actual deployment and configuration of network security functions based on the configuration report.

[0223] The inventors conducted extensive experiments on the method proposed in this invention. The experiments were conducted as follows: To verify the feasibility, effectiveness, and performance advantages of the method, the inventors compared the proposed method and system with the open-source network security feature configuration system Verefoo. The experiment was conducted in a test environment built on a 50-node network service graph topology. Different numbers of security policies were input for testing. The test task included five combinations of security policy types, with access control policies, channel protection policies, and packet inspection policies in a 4:4:2 ratio. Addressing the limitation of Verefoo only supporting single access control policy solutions, the method was extended to support channel protection and packet inspection policies. A compromise scheme of configuring different types of security policies in stages was adopted as the execution method for testing multi-type policy solutions, and this was compared with the joint configuration method of this invention.

[0224] The experiment evaluated the two methods from three core dimensions: policy satisfaction rate, number of rule deployments, and solution efficiency. Test results show that the joint configuration method of this invention maintains a stable 100% policy satisfaction rate in both single-policy and multi-policy-type solution scenarios. Verefoo, however, cannot guarantee a 100% policy satisfaction rate in multi-policy-type solution tasks due to its inability to achieve linkage between multiple security functions, leading to rule conflicts and coverage issues between security functions, and some security policies failing to execute effectively. The number of rule deployments in this invention is optimal in all test scenarios, significantly lower than Verefoo. Verefoo's phased configuration method lacks a global optimization perspective, resulting in redundant rule configurations and a much higher number of deployments than this invention. In multi-policy-type solution tasks, the solution speed of this invention is slightly lower than Verefoo because this method fully models the dependencies and conflicts between different types of security functions, requiring global solution of multiple linkage decision variables, resulting in higher computational complexity. However, in single-policy solution tasks, the modeling and solution logic of this invention is more targeted, and its solution efficiency surpasses that of Verefoo.

[0225] In summary, the method and system proposed in this invention have significant advantages in policy satisfaction and configuration optimization. The solution efficiency is superior in single-policy scenarios, and the efficiency in multi-policy scenarios decreases slightly to a reasonable cost of globally optimal configuration. Overall performance far surpasses existing similar technologies and can effectively adapt to the joint configuration requirements of multiple security functions in complex networks. Experimental results demonstrate that the method and system proposed in this invention are feasible and effective.

[0226] The present invention has been described in detail above with reference to the embodiments. Those skilled in the art can make various modifications to the present invention based on the above description. Therefore, certain details in the embodiments should not be construed as limiting the present invention. The scope of protection of the present invention shall be defined by the appended claims.

Claims

1. A network security function joint configuration method based on the maximum satisfiability modulus theory, characterized in that: The method includes the following steps: S101: Problem Modeling Process: The joint configuration problem of network security functions is modeled as a MaxSMT problem based on the maximum satisfiability modulus theory, specifically including the following input definitions and decision variable definitions: Input definition: Service Map ,in A network is a collection of nodes, including terminal nodes, routing nodes, server nodes, etc. This is the set of communication edges between nodes, and each edge... Corresponding to two nodes Communication links between them; Access control policy set Each access control policy , Includes attribute types: reachability or isolation. Reachability indicates which traffic is allowed to access the site. Isolation means that traffic can be blocked. ; Channel protection strategy set Each channel protection strategy includes a set of untrusted nodes and a set of inspection nodes; the communication traffic corresponding to untrusted nodes must be encrypted, and the communication traffic corresponding to inspection nodes must be inspected in plaintext. Packet inspection strategy set Each packet inspection policy explicitly requires security checks and operation logging for traffic with specific characteristics; Flow Atom Predicate Set Among them, the flow characteristic quintuple These represent the source / destination nodes, source / destination ports, and network protocols of the traffic, respectively. Definition of decision variables: Firewall variables: : indicates an edge Whether a firewall is deployed, among which Indicates deployment, Indicates no deployment; : indicates an edge The working modes of the firewall, among which Indicates whitelist mode. Indicates blacklist mode; : indicates an edge Is the flow in the set of atomic predicates AP? Configure explicit access rules, where Indicates configuration, This indicates that it is not configured. : indicates an edge Does the firewall on the device block traffic? The transmission, in which To indicate refusal, This indicates permission. CPS variables: : indicates an edge Whether or not the CPS (Channel Protection System) function is deployed, among which... Indicates deployment, Indicates no deployment; : indicates an edge Does CPS affect traffic? Perform encryption operations, where Indicates that encryption will be performed. Indicates that the action will not be taken; : indicates an edge Does CPS affect traffic? Perform the decryption operation, where This indicates that decryption will be performed. Indicates that the action will not be taken; : indicates an edge Does it actually affect traffic? An encryption operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented; : indicates an edge Does it actually affect traffic? Decryption was performed, where Indicates actual execution. This indicates that it was not actually implemented. IDS variables: : indicates an edge Whether to deploy an IDS (Intrusion Detection System) on the system, where Indicates deployment, Indicates no deployment; : indicates an edge Does the IDS on the network affect traffic? Perform the inspection operation, in which Indicates that an inspection will be performed. Indicates that the action will not be taken; : indicates an edge Does the IDS on the network affect traffic? Perform a recording operation, where Indicates execution record, Indicates that the action will not be taken; : indicates an edge Does it actually affect traffic? An inspection operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented; : indicates an edge Does it actually affect traffic? A recording operation was performed, in which Indicates actual execution. This indicates that it was not actually implemented. State variables: : Indicates flow rate On the side The encryption status on, where Indicates encryption status. Indicates plaintext status; : indicates an edge The execution order of various security functions is defined in six fixed complete sequence combinations, namely: This indicates the process of firewall → CPS → IDS. This indicates the process of firewall → IDS → CPS. This indicates CPS → Firewall → IDS. This indicates CPS→IDS→Firewall. This indicates IDS → Firewall → CPS. This indicates IDS → CPS → Firewall. S102: Hard Constraint Generation Process: Hard constraints are mandatory conditions that must be met. They are the foundation for ensuring network security requirements and normal function operation, and specifically include the following hard constraints: Firewall constraints: For each edge and each flow The firewall's rejection logic is determined based on the valid encryption state of the traffic before the firewall executes its rules. in, This indicates the effective encryption state of the traffic before the firewall executes, based on the edge. The execution order of security functions and the results of CPS operations are calculated as follows: In the above formula, Indicates flow rate Reach the edge The previous edge we passed, This indicates the edge where the CPS performs the encryption operation; Normal rule logic is satisfied: The encrypted default rules satisfy: CPS constraints: CPS encryption and decryption operation functions are defined as follows: The encrypted state of the traffic propagates along the communication path, for each edge and each flow Its encryption state satisfies: If the edge It's traffic. The first edge on the communication path, then This means that the initial state of the traffic is plaintext. CPS encryption and decryption operations are mutually exclusive, satisfying the following constraints: IDS constraints: The IDS check and record operation functions are defined as follows: in, This indicates the traffic before the IDS performs the inspection operation. The encryption state, according to the edge The execution order of security functions and the results of CPS operations are calculated. IDS can only inspect unencrypted data packets, satisfying a hard constraint: Access control policy constraints: For each reachability access control policy There is at least one communication path. The This indicates that the demand has been met. The set of all communication paths such that all edges on the path allow traffic. transmission, Demand The corresponding traffic satisfies: ,in, Representing a path The set of all edges contained therein; For each isolation access control policy All communication paths There must be at least one edge that rejects traffic. Transmission, satisfying: Channel protection strategy constraints: CPS protection strategy Each untrusted node , Representation strategy The set of untrusted nodes in the strategy Corresponding traffic Upon reaching the node Previously, encryption was required, and the encrypted data must be processed before reaching the node. Decryption operations must not be performed between them, satisfying the following condition: in, Representing a path From the starting point to the node sub-paths, Representing a path From the middle To the node Subpaths; For each inspection node , Representation strategy The set of check nodes in the data, if the traffic Upon reaching the node Since it has been encrypted before, it must be sent to the node. The previous decryption operation satisfied: In CPS, encryption and decryption operations must exist in pairs, and the encryption operation must be performed before the decryption operation, satisfying the following conditions: in, Representing a path From the middle Sub-paths leading to the destination; The communication path corresponding to traffic that has undergone CPS encryption or decryption must not be blocked by the firewall, satisfying the following: Packet inspection strategy constraints: For each packet inspection strategy There is at least one communication path. , Indicates satisfying the strategy The set of all communication paths, where at least one edge on each path has successfully checked unencrypted traffic. , Strategy The corresponding traffic satisfies: If the packet inspection policy q requires traffic logging, then the following must also be satisfied: S103: Soft Constraint Generation Process: Soft constraints are the optimization objectives, represented by a weighted maximum satisfiability form. Different weights are assigned to reflect the optimization priority. Deployment optimization, highest priority: Aiming to minimize the number of network security functions deployed in the network, while satisfying: in, Given the highest weight, minimizing deployment costs is the primary optimization objective. Configuration optimization, lowest priority: Aiming to minimize the number of configuration rules for network security functions, satisfying the following: in, With the lowest weight, configuration complexity is further reduced while ensuring the minimum deployment cost; S104: MaxSMT Solution Process: The MaxSMT problem established above is solved using the Optimize mode of the Z3 SMT solver. The specific process is as follows: Add all the hard constraints generated in step S102 to the Z3 SMT solver; All soft constraints generated in step S103 are added to the Z3 SMT solver in a weighted manner; Call the solver's check() method to solve; If the solution is successful, the model output by the solver is obtained; if the solution fails, no solution is returned, indicating that the optimization objective cannot be achieved while satisfying all hard constraints. S105: Result Extraction Process: Extract the joint configuration results of network security functions from the model output by the solver, specifically including: Firewall configuration information on each edge e, including firewall deployment status. Work mode and a list of explicit rules for each type of traffic. ; CPS configuration information on each edge e, including CPS deployment status. And a list of encryption / decryption rules for each type of traffic ( , ); IDS configuration information on each edge e, including IDS deployment status. And a list of inspection / logging rules for each type of traffic, including and ; If the node deployed on edge e is a multi-functional node, meaning it deploys multiple security functions simultaneously, then the execution order of the security functions on that edge will be used to determine the security function execution order. The deployment location and execution process of each security function in the composite node are clearly defined; the composite function node refers to a node that deploys multiple security functions simultaneously.

2. A network security function joint configuration system based on the maximum satisfiability modulus theory, using the method described in claim 1, characterized in that: The system includes the following modules: Input Module: This module is used to obtain the input data required for the joint configuration of network security functions, including the service graph G=(V,E), access control policy set, CPS protection policy set, packet inspection policy set, and traffic atomic predicate set, and to perform format validation and standardization processing on the input data to ensure the integrity and validity of the data; Modeling Module: Connected to the input module, this module is used to model the joint configuration problem of network security functions as a MaxSMT problem, including defining decision variables based on input data, namely: firewall variables, CPS variables, IDS variables and state variables, and generating corresponding variable identifiers and value range descriptions; Constraint Generation Module: Connected to the modeling module, it consists of hard constraint generation units and soft constraint generation units. Hard constraint generation unit: This unit is used to generate constraints such as firewall constraints, CPS constraints, IDS constraints, access control policy constraints, CPS protection policy constraints, and packet inspection policy constraints based on the decision variables and input data defined by the modeling module, and convert all hard constraints into logical expression formats that can be recognized by the Z3 SMT solver. Soft constraint generation unit: This unit is used to generate soft constraint conditions corresponding to deployment optimization and configuration optimization according to the optimization objective, assign weights to each soft constraint, and convert them into a weighted logical expression format that can be recognized by the Z3 SMT solver. Solver Module: Connected to the constraint generation module, with a built-in Z3 SMT solver. This module is used to receive the hard constraint logic expression and soft constraint weighted logic expression output by the constraint generation module, call the optimization mode of the Z3 SMT solver to solve the problem, and output the solution result, i.e., whether the solution is successful or not, and the corresponding model when the solution is successful. Result Extraction Module: Connected to the Solver Module, this module extracts firewall configuration information, CPS configuration information, IDS configuration information, and execution order and deployment location information of composite security function nodes from the model when the Solver Module outputs a successful solution. It also organizes the extracted configuration results into a standardized configuration report, including text descriptions and tables. When the Solver Module outputs a failed solution, it generates a no-solution warning report. Output module: Connected to the result extraction module, this module is used to output the configuration report or unsolvable prompt report generated by the result extraction module to the user in a visual manner, so that the user can deploy and configure network security functions according to the configuration report.

Images