Method, system, computer and storage medium for scheduling cloud security system traffic

Abstract

The present application relates to a method, system, computer and storage medium for orchestrating cloud security system traffic, wherein the method includes obtaining load capacity information of drainage devices and security products; determining whether the load capacity of the drainage device is sufficient to support external traffic; if the load capacity of the drainage device is sufficient to support external traffic, controlling the drainage device to receive external traffic; if the load capacity of the drainage device is insufficient to support external traffic, controlling the first load balancer to be mounted in front of the drainage device, and controlling the first load balancer to receive external traffic. Through this application, the problems of resource waste, high cost and short board effect in the existing cloud security system traffic orchestration system for drainage devices and security products with differentiated load capacities are solved, and it is achieved that users are supported to orchestrate a more flexible and higher performance cloud security system according to their actual device load conditions.

Description

Technical Field

[0001] The present application relates to the technical field of programmable application system security, and in particular to a method, system, computer and storage medium for programmable cloud security system traffic. Background Art

[0002] In recent years, with the continuous development of cloud computing technology and the continuous rise of cloud computing service providers at home and abroad, a multi-cloud pattern has gradually formed. With the development of the cloud computing market, many companies have begun to choose to migrate their businesses to the cloud, and companies do not just use one cloud, but use a combination of multiple clouds, such as public cloud, private cloud, hybrid cloud, etc. The adoption of multi-cloud by enterprises has become a mainstream trend. For various reasons (cost, compliance, avoiding vendor lock-in, etc.), there are fewer and fewer scenarios where companies use public cloud / private cloud alone, and most companies prefer to use multiple clouds. According to Flexera's 2020 cloud computing survey report, the vast majority of companies (93%) use multiple clouds, a 9% increase from 2019. On average, companies use more than 4 different clouds for production environments, including 2.2 public clouds, 2.2 private clouds, and experimental use of the other 4 clouds.

[0003] In public or private cloud scenarios, tenants have security protection requirements for their cloud hosts. One protection solution is to deploy multiple secure virtual machines on multiple host machines independent of the cloud environment to form a security resource pool, and then the cloud platform will pull tenant traffic into the security resource pool for security protection. Since there are multiple virtual security products in the security resource pool, and each virtual security product has multiple types, it is very important to efficiently orchestrate tenant traffic so that tenant traffic can be protected.

[0004] At present, with the development of computer science and technology, there are more and more types of application systems, and the data generated by application systems is also very large. Data assets are the core assets of enterprises, and their security is increasingly concerned by enterprises. In view of this, the protection of data assets is particularly important, and the value of security products emerges spontaneously. However, different customers have different needs for security, and the focus of the required protection is also different. The realization of different focuses can be achieved through the orchestration system. However, based on the existing orchestration system, when there are differences in the load capacity of drainage equipment and security products, the orchestration system is still fixed, and it is impossible to match multiple solutions based on the differences between the two to solve the problem, resulting in a waste of resources and an increase in costs. At the same time, when there are defects in the capabilities of a single security product, a short board effect will occur.

[0005] At present, the existing cloud security traffic orchestration system in the relevant technology is in a fixed state and cannot be orchestrated, so that the technical problems of resource waste, high cost and easy occurrence of weak board effect cannot be solved for the drainage equipment and security products with differentiated load capacity. No effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a method, system, computer and readable storage medium for scheduling cloud security system traffic, so as to at least solve the problem that the existing cloud security system traffic scheduling system in the related technology is in a fixed state and cannot be scheduled, so that the drainage devices and security products with differentiated load capacities cannot solve the problems of resource waste, high cost and easy occurrence of short board effect.

[0007] In a first aspect, an embodiment of the present application provides a method for orchestrating traffic in a cloud security system, which includes:

[0008] Obtain information on the load capacity of drainage equipment and safety products;

[0009] Determining whether the load capacity of the drainage device is sufficient to support the external flow;

[0010] If the load capacity of the drainage device is sufficient to support the external flow, then according to the size relationship between the load capacity of the drainage device and the load capacity of the safety product, the load relationship between the drainage device and the safety product is adjusted, and the drainage device is controlled to receive the external flow;

[0011] If the load capacity of the drainage device is insufficient to support external traffic, a first load balancer is controlled to be mounted in front of the drainage device, and the load relationship between the drainage device and the security product is adjusted according to the relationship between the load capacity of the drainage device and the load capacity of the security product, and the first load balancer is controlled to receive the external traffic.

[0012] In some embodiments, if the load capacity of the drainage device is sufficient to support the external flow, then according to the size relationship between the load capacity of the drainage device and the load capacity of the safety product, the load relationship between the drainage device and the safety product is adjusted, and the specific steps of controlling the drainage device to receive the external flow include:

[0013] Determining whether the load capacity of the drainage device is less than the load capacity of the safety product;

[0014] If so, the safety product is controlled to receive the flow introduced by the drainage device and other drainage devices other than the drainage device.

[0015] In some embodiments, after the step of determining whether the load capacity of the drainage device is less than the load capacity of the safety product, the method further includes:

[0016] If the load capacity of the traffic diversion device is greater than the load capacity of the security product, control a second load balancer to be mounted after the traffic diversion device, and control the second load balancer to receive the external traffic;

[0017] The security product and other security products other than the security product are controlled to receive the traffic introduced by the second load balancer.

[0018] In some embodiments, if the load capacity of the drainage device is insufficient to support external traffic, a first load balancer is controlled to be mounted in front of the drainage device, and the load relationship between the drainage device and the security product is adjusted according to the size relationship between the load capacity of the drainage device and the load capacity of the security product, and the specific steps of controlling the first load balancer to receive external traffic include:

[0019] The flow diversion device and other flow diversion devices other than the flow diversion device are controlled to receive the traffic introduced by the first load balancer.

[0020] Determine whether the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product;

[0021] If yes, control the third load balancer to be mounted behind the flow diversion device and other flow diversion devices other than the flow diversion device, and control the third load balancer to receive the external traffic;

[0022] The security product and other security products other than the security product are controlled to receive the traffic introduced by the third load balancer.

[0023] In some embodiments, after the step of determining whether the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product, the method further includes:

[0024] If the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is less than the load capacity of the safety product; then the safety product is controlled to receive the flow introduced by the drainage device and other drainage devices other than the drainage device.

[0025] In a second aspect, an embodiment of the present application provides a system in which cloud security system traffic can be orchestrated, comprising:

[0026] Acquisition module: used to obtain the load capacity information of drainage equipment and safety products;

[0027] The first judgment module is used to judge whether the load capacity of the drainage device is sufficient to support the external flow;

[0028] A first control module: for adjusting the load relationship between the drainage device and the safety product according to the size relationship between the load capacity of the drainage device and the load capacity of the safety product, and controlling the drainage device to receive the external flow if the load capacity of the drainage device is sufficient to support the external flow;

[0029] The second control module is used to control the mounting of a first load balancer in front of the drainage device if the load capacity of the drainage device is insufficient to support external traffic, adjust the load relationship between the drainage device and the security product according to the relationship between the load capacity of the drainage device and the load capacity of the security product, and control the first load balancer to receive the external traffic.

[0030] In some embodiments, the first control module includes:

[0031] A first judging unit: used to judge whether the load capacity of the drainage device is less than the load capacity of the safety product;

[0032] The first receiving unit is used to control the safety product to receive the flow introduced by the drainage device and other drainage devices other than the drainage device if the load capacity of the drainage device is smaller than the load capacity of the safety product.

[0033] In some embodiments, the first control module further includes:

[0034] A first introduction unit, configured to control a second load balancer to be mounted after the traffic diversion device if the load capacity of the traffic diversion device is greater than the load capacity of the security product, and control the second load balancer to receive the external traffic;

[0035] A first distribution unit is used to control the security product and other security products other than the security product to receive the traffic introduced by the second load balancer.

[0036] In some embodiments, the second control module includes:

[0037] A second distribution unit: used for controlling the flow diversion device and other flow diversion devices other than the flow diversion device to receive the traffic introduced by the first load balancer;

[0038] A second judgment unit: used to judge whether the sum of the load capacity of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product;

[0039] A second introduction unit: configured to control the third load balancer to be mounted behind the flow diversion device and other flow diversion devices other than the flow diversion device, and control the third load balancer to receive the external traffic if the sum of the load capacities of the flow diversion device and other flow diversion devices other than the flow diversion device is greater than the load capacity of the security product;

[0040] The third distribution unit is used to control the security product and other security products other than the security product to receive the traffic introduced by the third load balancer.

[0041] The second control module further includes:

[0042] The second receiving unit is used to control the safety product to receive the flow introduced by the drainage device and other drainage devices other than the drainage device if the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is less than the load capacity of the safety product.

[0043] In a third aspect, an embodiment of the present application provides a computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for orchestrating cloud security system traffic as described in the first aspect above is implemented.

[0044] In a fourth aspect, an embodiment of the present application provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for programmable cloud security system traffic as described in the first aspect above.

[0045] Compared with the related art, the cloud security system traffic orchestration method, system, computer and readable storage medium provided in the embodiments of the present application, by designing the cloud security system traffic orchestration system in the prior art to be in an orchestrated state to support a variety of different traffic deployment schemes, solves the problem that the cloud security system traffic orchestration system in the prior art is in a fixed state, resulting in drainage devices and security products for differentiated load capacities, and cannot solve the problems of resource waste, high cost and easy occurrence of weak board effect, and realizes support for users to orchestrate a more flexible and higher performance cloud security system according to their actual equipment load conditions.

[0046] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0048] Figure 1 This is a flow chart of a method for orchestrating cloud security system traffic provided by Embodiment 1 of the present invention;

[0049] Figure 2 This is a schematic diagram of the cloud security system traffic orchestration process provided by the first embodiment of the present invention;

[0050] Figure 3 This is a system structure diagram of cloud security system traffic programmability corresponding to the method of embodiment 1 provided in embodiment 2 of the present invention;

[0051] Figure 4 This is a flow chart of a method for orchestrating cloud security system traffic provided by Embodiment 3 of the present invention;

[0052] Figure 5 This is a schematic diagram of the cloud security system traffic orchestration process provided by Embodiment 3 of the present invention;

[0053] Figure 6 This is a system structure diagram of cloud security system traffic programmable corresponding to the method of embodiment 3 provided in embodiment 4 of the present invention;

[0054] Figure 7 This is a flow chart of a method for orchestrating cloud security system traffic provided by Embodiment 5 of the present invention;

[0055] Figure 8 This is a schematic diagram of the cloud security system traffic orchestration process provided by Embodiment 5 of the present invention;

[0056] Fig. 9 This is a system structure diagram of cloud security system traffic programmable corresponding to the method of embodiment 5 provided in embodiment 6 of the present invention;

[0057] Fig.10 This is a flow chart of a method for orchestrating cloud security system traffic provided by Embodiment 7 of the present invention;

[0058] Fig.11 This is a schematic diagram of the cloud security system traffic orchestration process provided by Embodiment 7 of the present invention;

[0059] Fig.12 This is a system structure diagram of cloud security system traffic programmable corresponding to the method of embodiment 7 provided in embodiment 8 of the present invention;

[0060] Fig.13 It is a schematic diagram of the hardware structure of a computer provided in Embodiment 9 of the present invention.

[0061] Description of reference numerals:

[0062] 510. Acquisition module;

[0063] 520, first judgment module;

[0064] 530, first control module; 531, first judgment unit; 532, first receiving unit; 533, first introduction unit; 534, first distribution unit;

[0065] 540, second control module; 541, second distribution unit; 542, second judgment unit; 543, second introduction unit; 544, third distribution unit; 545, second receiving unit;

[0066] 60. Bus; 61. Processor; 62. Memory; 63. Communication interface. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0068] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0069] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0070] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0071] The various technologies described in this application can be used in various wireless communication systems, such as 2G, 3G, 4G, 5G communication systems and next-generation communication systems, and also for example, Global System for Mobile communications (GSM), Code Division Multiple Access (CDMA) system, Time Division Multiple Access (TDMA) system, Wideband Code Division Multiple Access Wireless (WCDMA), Frequency Division Multiple Addressing (FDMA) system, Orthogonal Frequency, Division Multiple Access (OFDMA) system, Single Carrier FDMA (SC, FDMA) system, General Packet Radio Service (GPRS) system, Long Term Evolution (LTE) system, 5G New Radio (NR) system and other such communication systems.

[0072] The cloud security system traffic orchestration system provided in this embodiment can be integrated in a base station, a radio remote unit (Radio Remote Unit, referred to as RRU) or any other network element device that requires radio frequency transmission and reception. The base station in this article can be a device in the access network that communicates with the wireless terminal through one or more sectors on the air interface. The base station can be used to convert received air frames to Internet Protocol (Internet Protocol, referred to as IP) packets, as a router between the wireless terminal and the rest of the access network, where the rest of the access network may include an IP network. The base station can also coordinate the attribute management of the air interface. For example, the base station can be a base station (Base Transceiver Station, referred to as BTS) in GSM or CDMA, or a base station (Node B) in WCDMA, or an evolutionary base station (evolutional Node B, referred to as eNB or e, Node B) in LTE, or a generation Node B (referred to as gNB) in 5G NR, which is not limited in this application.

[0073] Embodiment 1

[0074] This embodiment provides a method for orchestrating cloud security system traffic. Figure 1 is a flow chart of a method for scheduling cloud security system traffic according to an embodiment of the present application, such as Figure 1 As shown, the process includes the following steps:

[0075] Step S101, obtaining load capacity information of drainage equipment and safety products.

[0076] Among them, the traffic diversion device is mainly responsible for forwarding the traffic during the operation of the cloud security system, and plays the role of associating the security products so that the traffic flows between the security products; the security products are mainly responsible for cleaning and filtering the user's business traffic, outputting the traffic required for the business, and clearing attacks and threats in the traffic.

[0077] Furthermore, the information on the load capacity of the drainage device and the load capacity of the safety product can be obtained by referring to the management page or user manual of the relevant device.

[0078] Step S102, determining whether the load capacity of the drainage device is sufficient to support external flow.

[0079] Step S103: If yes, control the drainage device to receive the external flow, and determine whether the load capacity of the drainage device is less than the load capacity of the safety product.

[0080] Step S104: If yes, control the safety product to receive the flow introduced by the drainage device and other drainage devices other than the drainage device.

[0081] To sum up the above steps, the specific traffic arrangement process can be Figure 2 As shown in the figure, drainage device A and drainage device B receive external traffic respectively, and respectively introduce the received traffic into the security product. Through the description of the above process, it can be known that drainage device A and drainage device B share security product A, so that the load capacity of security product A is maximized. It should be noted that: for simplicity, only drainage device A and drainage device B are drawn when drawing. As long as the capacity of security product A is sufficient, there can be N drainage devices.

[0082] Therefore, through the above steps, when the external traffic is very small and the load capacity of the drainage device can withstand the external traffic, but the load capacity of the drainage device is weaker than that of the security product, the method described in this embodiment can be used to achieve the sharing of security products in the orchestration link by connecting multiple drainage devices to the security device. Compared with the deployment mode of "one drainage device connected to one security product" of the traditional orchestration system, the creation of security products is reduced, thereby achieving the purpose of reducing resource consumption and saving costs.

[0083] Embodiment 2

[0084] This embodiment provides a structural block diagram of a system corresponding to the method described in Embodiment 1. Figure 3 is a structural block diagram of a system in which cloud security system traffic can be arranged according to an embodiment of the present application, such as Figure 3 As shown, the system includes:

[0085] Acquisition module 510: used to obtain load capacity information of drainage equipment and safety products;

[0086] The first judgment module 520 is used to judge whether the load capacity of the drainage device is sufficient to support the external flow.

[0087] The first control module 530 is configured to control the drainage device to receive the external flow if the load capacity of the drainage device is sufficient to support the external flow.

[0088] Furthermore, the first control module 530 includes:

[0089] The first judging unit 531 is used to judge whether the load capacity of the drainage device is less than the load capacity of the safety product;

[0090] The first receiving unit 532 is used to control the safety product to receive the flow introduced by the drainage device and other drainage devices other than the drainage device if the load capacity of the drainage device is smaller than the load capacity of the safety product.

[0091] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0092] Implementation Three

[0093] This embodiment provides a method for orchestrating cloud security system traffic. Figure 4 is a flow chart of a method for scheduling cloud security system traffic according to an embodiment of the present application, such as Figure 4 As shown, the process includes the following steps:

[0094] Step S201, obtaining the load capacity information of the drainage device and the safety product.

[0095] Among them, the traffic diversion device is mainly responsible for forwarding the traffic during the operation of the cloud security system, and plays the role of associating the security products so that the traffic flows between the security products; the security products are mainly responsible for cleaning and filtering the user's business traffic, outputting the traffic required for the business, and clearing attacks and threats in the traffic.

[0096] Furthermore, the information on the load capacity of the drainage device and the load capacity of the safety product can be obtained by referring to the management page or user manual of the relevant device.

[0097] Step S202, determining whether the load capacity of the drainage device is sufficient to support external flow.

[0098] Step S203: If yes, control the drainage device to receive the external flow, and determine whether the load capacity of the drainage device is less than the load capacity of the safety product.

[0099] Step S204: If not, control the second load balancer to be mounted after the traffic diversion device, and control the second load balancer to receive the external traffic.

[0100] Step S205: Control the security product and other security products other than the security product to receive the traffic introduced by the second load balancer.

[0101] To sum up the above steps, the specific traffic arrangement process can be Figure 5 As shown in the figure, the drainage device A receives external traffic, and the traffic of the drainage device A is introduced into the second load balancer, and the second load balancer distributes the traffic to security products A and B. Through the description of the above process, it can be known that the traffic between the drainage device A and the security product is distributed through the second load balancer, so that the weak load capacity of the security product is compensated, which greatly improves the performance of the system. It should be noted that: for simplicity, only security products A and B are drawn when drawing. As long as the capacity of load balancer A is sufficient, N security products can be mounted.

[0102] Therefore, through the above steps, when the external traffic is very small and the load capacity of the drainage device can withstand the external traffic, but the load capacity of the drainage device is stronger than that of the security product, the method described in this embodiment can be used to realize that the drainage device loads multiple security products. The drainage device and the security product are connected through a load balancer, so that the load capacity of the security device does not become the shortcoming of the system, thereby enabling the system to meet high performance requirements.

[0103] Embodiment 4

[0104] This embodiment provides a structural block diagram of a system corresponding to the method described in Embodiment 3. Figure 6 is a structural block diagram of a system in which cloud security system traffic can be arranged according to an embodiment of the present application, such as Figure 6 As shown, the system includes:

[0105] Acquisition module 510: used to obtain load capacity information of drainage equipment and safety products;

[0106] The first determination module 520 is used to determine whether the load capacity of the drainage device is sufficient to support the external flow;

[0107] The first control module 530 is configured to control the drainage device to receive the external flow when the load capacity of the drainage device is sufficient to support the external flow.

[0108] Furthermore, the first control module 530 includes:

[0109] The first judging unit 531 is used to judge whether the load capacity of the drainage device is less than the load capacity of the safety product;

[0110] A first introduction unit 533 is configured to control a second load balancer to be mounted after the traffic diversion device if the load capacity of the traffic diversion device is greater than the load capacity of the security product, and control the second load balancer to receive the external traffic;

[0111] The first distribution unit 534 is used to control the security product and other security products other than the security product to receive the traffic introduced by the second load balancer.

[0112] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0113] Embodiment 5

[0114] This embodiment provides a method for orchestrating cloud security system traffic. Figure 7 is a flow chart of a method for scheduling cloud security system traffic according to an embodiment of the present application, such as Figure 7 As shown, the process includes the following steps:

[0115] Step S301, obtaining load capacity information of drainage equipment and safety products;

[0116] The traffic diversion device is mainly responsible for forwarding traffic during the operation of the cloud security system, and plays a role in associating the security products so that traffic flows between the security products; the security products are mainly responsible for cleaning and filtering the user's business traffic, outputting the traffic required for the business, and removing attacks and threats in the traffic;

[0117] Furthermore, the information on the load capacity of the drainage device and the load capacity of the safety product can be obtained by referring to the management page or user manual of the relevant device.

[0118] Step S302, determining whether the load capacity of the drainage device is sufficient to support external flow.

[0119] Step S303: If not, control the flow diversion device and other flow diversion devices other than the flow diversion device to receive the traffic introduced by the first load balancer.

[0120] Step S304, determining whether the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product.

[0121] Step S305: If yes, control the mounting of a third load balancer behind the flow diversion device and other flow diversion devices other than the flow diversion device, and control the third load balancer to receive the external traffic.

[0122] Step S306: Control the security product and other security products other than the security product to receive the traffic introduced by the third load balancer.

[0123] To sum up the above steps, the specific traffic arrangement process can be Figure 8 As shown in the figure, the first load balancer receives external traffic; the first load balancer distributes the traffic to the drainage device A and the drainage device B; since the load capacity of the drainage device is stronger than that of the security product, the drainage device A introduces the traffic to the third load balancer; the drainage device B introduces the traffic to the third load balancer; the third load balancer distributes the traffic to the security product A; the third load balancer distributes the traffic to the security product B. Through the description of the above process, it can be known that the traffic between the drainage device B and the security product is distributed through the load balancer, so that the weak load capacity of the security product is compensated, which greatly improves the performance of the system, and the external traffic is received through the second load balancer, so that the short board of the load capacity of the drainage device is compensated. It should be noted that: for simplicity, only security products A and B are drawn when drawing. As long as the capacity of the third load balancer is sufficient, N security products can be mounted. Similarly, the load balancer can also mount N drainage devices.

[0124] Therefore, through the above steps, when the capacity of the drainage device is not enough to bear the impact of external traffic, it is necessary to mount a load balancer in front of the drainage device to receive external incoming traffic and reduce the impact on the drainage device, thereby achieving high performance of the system. At the same time, there is no need to change the load capacity of the existing drainage equipment, reducing manpower investment.

[0125] Embodiment 6

[0126] This embodiment provides a structural block diagram of a system corresponding to the method described in Embodiment 5, wherein the system is used for a security product to receive traffic introduced by a traffic diversion device in a non-one-to-one correspondence. Fig. 9 is a structural block diagram of a system in which cloud security system traffic can be arranged according to an embodiment of the present application, such as Fig. 9 As shown, the system includes:

[0127] Acquisition module 510: used to obtain load capacity information of drainage equipment and safety products;

[0128] The first determination module 520 is used to determine whether the load capacity of the drainage device is sufficient to support the external flow;

[0129] The second control module 540 is used to control the mounting of a first load balancer in front of the diversion device if the load capacity of the diversion device is insufficient to support the external traffic, and control the first load balancer to receive the external traffic.

[0130] Furthermore, the second control module 540 includes:

[0131] The second distribution unit 541 is used to control the traffic diversion device and other traffic diversion devices other than the traffic diversion device to receive the traffic introduced by the first load balancer;

[0132] The second judging unit 542 is used to judge whether the sum of the load capacity of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product;

[0133] The second introduction unit 543 is configured to control the third load balancer to be mounted after the flow diversion device and other flow diversion devices other than the flow diversion device, and control the third load balancer to receive the external traffic if the sum of the load capacities of the flow diversion device and other flow diversion devices other than the flow diversion device is greater than the load capacity of the security product;

[0134] The third distribution unit 544 is used to control the security product and other security products other than the security product to receive the traffic introduced by the third load balancer.

[0135] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0136] Embodiment 7

[0137] This embodiment provides a method for orchestrating cloud security system traffic. Fig.10 is a flow chart of a method for scheduling cloud security system traffic according to an embodiment of the present application, such as Fig.10 As shown, the process includes the following steps:

[0138] Step S401, obtaining information on the load capacity of drainage equipment and safety products;

[0139] The traffic diversion device is mainly responsible for forwarding traffic during the operation of the cloud security system, and plays a role in associating the security products so that traffic flows between the security products; the security products are mainly responsible for cleaning and filtering the user's business traffic, outputting the traffic required for the business, and removing attacks and threats in the traffic;

[0140] Furthermore, the information on the load capacity of the drainage device and the load capacity of the safety product can be obtained by referring to the management page or user manual of the relevant device.

[0141] Step S402, determining whether the load capacity of the drainage device is sufficient to support external flow.

[0142] Step S403: If not, control the flow diversion device and other flow diversion devices other than the flow diversion device to receive the traffic introduced by the first load balancer.

[0143] Step S404, determining whether the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product.

[0144] Step S405: if not, control the safety product to receive the flow introduced by the flow-guiding device and other flow-guiding devices other than the flow-guiding device.

[0145] To sum up the above steps, the specific traffic arrangement process can be Fig.11As shown in the figure, the first load balancer receives external traffic; the first load balancer distributes the traffic to the drainage device A and the drainage device B; since the load capacity of the drainage device is weaker than that of the security product, the drainage device A introduces the traffic to the security product A; the drainage device B introduces the traffic to the security product A. Through the description of the above process, it can be known that receiving external traffic through the load balancer A makes up for the shortcomings of the drainage device's load capacity and improves the overall performance.

[0146] Therefore, through the above steps, when the capacity of the drainage device is not enough to bear the impact of external traffic, it is necessary to mount a load balancer in front of the drainage device to receive external incoming traffic and reduce the impact on the drainage device, thereby achieving high performance of the system. At the same time, there is no need to change the load capacity of the existing drainage equipment, reducing manpower investment.

[0147] Embodiment 8

[0148] This embodiment provides a structural block diagram of a system corresponding to the method described in Embodiment 7, wherein the system is used for a security product to receive traffic introduced by a traffic diversion device in a non-one-to-one correspondence. Fig.12 is a structural block diagram of a system in which cloud security system traffic can be arranged according to an embodiment of the present application, such as Fig.12 As shown, the system includes:

[0149] Acquisition module 510: used to acquire information on the load capacity of drainage equipment and the load capacity of safety products;

[0150] The first determination module 520 is used to determine whether the load capacity of the drainage device is sufficient to support the external flow;

[0151] The second control module 540 is used to control the mounting of a first load balancer in front of the flow diversion device when the load capacity of the flow diversion device is insufficient to support the external flow, and control the first load balancer to receive the external flow.

[0152] Furthermore, the second control module 540 includes:

[0153] The second distribution unit 541 is used to control the traffic diversion device and other traffic diversion devices other than the traffic diversion device to receive the traffic introduced by the first load balancer.

[0154] The second judging unit 542 is used to judge whether the sum of the load capacity of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product;

[0155] The second receiving unit 545 is used to control the safety product to receive the flow introduced by the drainage device and other drainage devices other than the drainage device if the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is less than the load capacity of the safety product.

[0156] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0157] Embodiment 9

[0158] Combination Figure 1 , Figure 4 , Figure 7 and Fig.10 The method for programmable cloud security system traffic in the embodiment of the present application described above can be implemented by a computer. Fig.13 Schematic diagram of the hardware structure of a computer according to an embodiment of the present application.

[0159] The computer device may include a processor 61 and a memory 62 storing computer program instructions.

[0160] Specifically, the processor 61 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0161] Among them, the memory 62 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 62 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 62 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 62 may be inside or outside the data processing device. In a specific embodiment, the memory 62 is a non-volatile memory. In a specific embodiment, the memory 62 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (Programmable Read, Only Memory, abbreviated as PROM), an erasable PROM (Erasable ProgrammableRead, Only Memory, abbreviated as EPROM), an electrically erasable PROM (Electrically Erasable ProgrammableRead, Only Memory, abbreviated as EEPROM), an electrically alterable ROM (Electrically Alterable Read, Only Memory, abbreviated as EAROM) or a flash memory (FLASH) or a combination of two or more of the above. Under appropriate circumstances, the RAM can be a static random access memory (Static Random, Access Memory, abbreviated as SRAM) or a dynamic random access memory (Dynamic Random Access Memory, abbreviated as DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (Fast Page Mode Dynamic Random Access Memory, abbreviated as FPMDRAM), an extended data output dynamic random access memory (Extended Date Out Dynamic RandomAccess Memory, abbreviated as EDODRAM), a synchronous dynamic random access memory (Synchronous Dynamic Random, Access Memory, abbreviated as SDRAM), etc.

[0162] The memory 62 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 61 .

[0163] The processor 61 reads and executes computer program instructions stored in the memory 62 to implement any one of the cloud security system traffic programmable methods in the above-mentioned embodiments one, three, five, and seven.

[0164] In some embodiments, the computer may further include a communication interface 63 and a bus 60. Fig.13 As shown, the processor 61, the memory 62, and the communication interface 63 are connected via a bus 60 and communicate with each other.

[0165] The communication interface 63 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication interface 63 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0166] The bus 60 includes hardware, software or both, and couples the components of the computer device to each other. The bus 80 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 80 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI, Express (PCI, X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 60 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0167] The computer can execute the cloud security system traffic programmable method in the first, third, fifth, and seventh embodiments of the present application based on the obtained cloud security system traffic programmable system, thereby realizing the combination Figure 1 , Figure 4 , Figure 7 and Fig.10 A method for orchestrating traffic in a cloud security system is described in.

[0168] In addition, in combination with the method for scheduling cloud security system traffic in the above embodiments 1, 3, 5, and 7, the embodiment of the present application can provide a storage medium for implementation. The storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the methods for scheduling cloud security system traffic in the above embodiments 1, 3, 5, and 7 is implemented.

[0169] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0170] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for scheduling cloud security system traffic, characterized in that: include: Obtain information on the load capacity of drainage equipment and safety products; Determining whether the load capacity of the drainage device is sufficient to support the external flow; If the load capacity of the drainage device is sufficient to support the external flow, then according to the size relationship between the load capacity of the drainage device and the load capacity of the safety product, the load relationship between the drainage device and the safety product is adjusted, and the drainage device is controlled to receive the external flow; If the load capacity of the drainage device is insufficient to support external traffic, a first load balancer is controlled to be mounted in front of the drainage device, and the load relationship between the drainage device and the security product is adjusted according to the size relationship between the load capacity of the drainage device and the load capacity of the security product, and the first load balancer is controlled to receive the external traffic; If the load capacity of the drainage device is sufficient to support the external flow, then according to the size relationship between the load capacity of the drainage device and the load capacity of the safety product, the load relationship between the drainage device and the safety product is adjusted, and the specific steps of controlling the drainage device to receive the external flow include: Determining whether the load capacity of the drainage device is less than the load capacity of the safety product; If so, the safety product is controlled to receive the flow introduced by the drainage device and other drainage devices other than the drainage device.

2. The method for scheduling cloud security system traffic according to claim 1, characterized in that: After the step of determining whether the load capacity of the drainage device is less than the load capacity of the safety product, the method further includes: If the load capacity of the traffic diversion device is greater than the load capacity of the security product, control a second load balancer to be mounted after the traffic diversion device, and control the second load balancer to receive the external traffic; The security product and other security products other than the security product are controlled to receive the traffic introduced by the second load balancer.

3. The method for scheduling cloud security system traffic according to claim 1, characterized in that: If the load capacity of the drainage device is insufficient to support external traffic, the first load balancer is controlled to be mounted in front of the drainage device, and the load relationship between the drainage device and the security product is adjusted according to the size relationship between the load capacity of the drainage device and the load capacity of the security product, and the specific steps of controlling the first load balancer to receive external traffic include: Controlling the flow diversion device and other flow diversion devices other than the flow diversion device to receive the traffic introduced by the first load balancer; Determine whether the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product; If yes, control the third load balancer to be mounted behind the flow diversion device and other flow diversion devices other than the flow diversion device, and control the third load balancer to receive the external traffic; The security product and other security products other than the security product are controlled to receive the traffic introduced by the third load balancer.

4. The method for scheduling cloud security system traffic according to claim 3, characterized in that: After the step of determining whether the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is greater than the load capacity of the safety product, the method further includes: If the sum of the load capacities of the drainage device and other drainage devices other than the drainage device is less than the load capacity of the safety product, the safety product is controlled to receive the flow introduced by the drainage device and other drainage devices other than the drainage device.

5. A cloud security system traffic programmable system, characterized in that: include: Acquisition module: used to obtain the load capacity information of drainage equipment and safety products; The first judgment module is used to judge whether the load capacity of the drainage device is sufficient to support the external flow; A first control module: for adjusting the load relationship between the drainage device and the safety product according to the size relationship between the load capacity of the drainage device and the load capacity of the safety product, and controlling the drainage device to receive the external flow if the load capacity of the drainage device is sufficient to support the external flow; The second control module is used for controlling the first load balancer to be mounted in front of the drainage device if the load capacity of the drainage device is insufficient to support the external traffic, adjusting the load relationship between the drainage device and the security product according to the size relationship between the load capacity of the drainage device and the load capacity of the security product, and controlling the first load balancer to receive the external traffic; The first control module comprises: A first judging unit: used to judge whether the load capacity of the drainage device is less than the load capacity of the safety product; The first receiving unit is used to control the safety product to receive the flow introduced by the drainage device and other drainage devices other than the drainage device if the load capacity of the drainage device is smaller than the load capacity of the safety product.

6. The cloud security system traffic programmable system according to claim 5, characterized in that: The first control module also includes: A first introduction unit, configured to control a second load balancer to be mounted after the traffic diversion device if the load capacity of the traffic diversion device is greater than the load capacity of the security product, and control the second load balancer to receive the external traffic; A first distribution unit is used to control the security product and other security products other than the security product to receive the traffic introduced by the second load balancer.

7. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for orchestrating cloud security system traffic as described in any one of claims 1 to 4 is implemented.

8. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for programmable cloud security system traffic as described in any one of claims 1 to 4 is implemented.

Images