An intent-driven cloud security service system and method

Abstract

The present invention belongs to the field of network security technology, and discloses an intent-driven cloud security service system and method, including an information collection layer for collecting various types of information by adopting a multi-level detection method combining coarse and fine granularity, and aggregating and analyzing the collected data; an intent enabling layer for generating a desire to execute a defensive security strategy based on the data processing result and according to the BDI theory, determining the intention to eliminate network intrusion, and completing intent translation, policy verification, and configuration distribution; and a resource orchestration layer for searching for an appropriate NSF through a security controller, and implementing the strategy by matching the strategy with the security function of the NSF. The present invention provides an automated and virtualized system for security service providers, and provides simple, fast, and flexible cloud-based security services according to intent, which can reduce configuration time and workload, and improve resource utilization of security services.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to an intent-driven cloud security service system and method. Background Art

[0002] At present, with the continuous expansion of the Internet, network management and operation and maintenance have become extremely complex. Network autonomy has become the trend of future network development, and intent-driven networking (IDN) has emerged. As an emerging network technology, IDN can automatically convert, verify, deploy, configure and optimize itself according to the operator's intention to achieve the target network state, and can automatically resolve abnormal events to ensure network reliability. IDN provides full life cycle management for network elements while collecting network status. Traditional networks rely on administrators to enter specific execution commands; under intent-driven, administrators do not need to directly enter policy commands, but only need to enter the required business intent, that is, "what kind of situation do I want the network to achieve" or "what kind of network service do I want to obtain". With its advantages in intent translation, closed-loop verification and automated deployment, IDN has become another revolutionary network technology after software-defined networking.

[0003] Network Function Virtualization (NFV) technology makes full use of the characteristics of hardware and software decoupling and uses virtualization technologies such as virtual machines or containers to build virtual networks, providing a new method for designing, deploying, and managing network services. Its main idea is to decouple physical network devices from the network functions running on them, which means that one network function can be regarded as an instance of ordinary software. In this way, a large number of network devices can be merged into high-capacity servers. For a given service, it can be decomposed into multiple virtual network functions (VNFs), which can be implemented in software and run on general servers. They can be easily deployed in different places in the network without purchasing and installing new hardware. NFV technology is completely changing the entire IT field, realizing the functions of dedicated hardware devices on the software platform in an economical and efficient way, breaking the bottleneck of traditional large-scale network construction and operation, shortening the development and deployment cycle of network functions, providing users with flexible services, and reducing economic development costs. It has become the first choice for operators to cope with various network challenges.

[0004] Network administrators in traditional networks manage the network through specific configurations stored on each device. As the scale of networks continues to increase and network services become more diverse, when network configuration changes involve multiple network devices, network administrators need to master a lot of security knowledge for each type of network security device.

[0005] Prior art: A manual configuration method for network security policies. The method includes: during the operation of the network, trial-running the alternative security rules of each node of the network; evaluating the security performance of each node running the alternative security rules according to the configured security criteria; and replacing the security rules currently running on each node with the alternative security rules when having higher security performance. This method requires configuration personnel to manually configure and maintain security policies based on their own experience and user feedback, which has the problem of difficult configuration and easy errors. This problem is particularly prominent for small and medium-sized enterprises with low configuration personnel skills.

[0006] The second existing technology provides security services by deploying a security operation center in the enterprise. In specific implementation, the security operation center deployed in the enterprise collects security events at the host, network and application levels, and then pushes the security events to the security service provider in the form of work orders. The security service provider deploys network security equipment for each type of security event. This method is limited by the provider's energy and experience, resulting in low processing efficiency of security services and increased configuration error rate.

[0007] Through the above analysis, the problems and defects of the prior art are as follows:

[0008] (1) When using multiple types of network security devices, it is necessary to master a large amount of security knowledge for each type of network security device. Managing such a variety of devices requires a large number of experts, resulting in high hiring costs.

[0009] (2) The network environment changes dynamically. Whenever new technologies are developed, new equipment is deployed, or new problems arise, it takes a lot of time to complete the deployment of network security equipment, which also leads to an increase in the network configuration error rate.

[0010] The significance of solving the above technical problems: The intent-driven cloud security service system simplifies the operational processes of security service providers through automation and virtualization, provides users with simple, fast and flexible cloud-based security services, and improves the resource utilization of security services. Summary of the invention

[0011] In view of the problems existing in the prior art, the present invention provides an intent-driven cloud security service system and method.

[0012] The present invention is implemented in such a way that an intent-driven cloud security service system comprises:

[0013] The information collection layer is used to collect various types of information by adopting a multi-level detection method that combines coarse and fine granularity, and to aggregate and analyze the collected data;

[0014] The intention enabling layer is used to generate the desire to execute defense security strategies after obtaining the belief of network intrusion based on the data processing results and according to the BDI theory, determine the intention to eliminate network intrusion, and complete the intention translation, policy verification, and configuration delivery;

[0015] The resource orchestration layer is used to search for appropriate NSFs through the security controller, implement policies by matching them with the security functions of the NSFs, select one or more NSFs for policy provisioning based on the security functions of the registered NSFs, and if the selected NSF is not activated, the NSF will be instantiated using the NFV framework to provide corresponding security services through the instantiated NSFs.

[0016] The information collection layer provides a variety of data information through comprehensive detection of network status; the intent enabling layer infers network intent and completes intent-policy mapping, and ensures the correctness of network execution policy through policy verification and configuration distribution; the resource orchestration layer implements specific policies through NSF instances to provide security services required by the network. The intent-driven cloud security service system can provide fast and flexible security services based on specific intents, and provides security service providers with an automated system for NSF provisioning, which can quickly provide appropriate security services. At the same time, providers can efficiently and flexibly manage the resources of cloud servers (i.e., NSFs) without installing any security equipment.

[0017] Furthermore, the intent enabling layer includes:

[0018] The intent translation module is responsible for translating the collected intents and realizing the process from intent to strategy;

[0019] The policy verification module is responsible for verifying the generated policy. After the policy is generated, the conflict resolution and consistency check module is responsible for resolving conflicts between multiple policies or between new policies and existing policies. At the same time, the user is fed back the results and asked whether the negotiation is acceptable.

[0020] The configuration delivery module is responsible for delivering specific policies after the requirements are met. It completes the appropriate policy configuration by querying the policy library and submits it to the lower-level resource orchestration layer for processing.

[0021] Furthermore, the resource orchestration layer includes:

[0022] The security controller centrally manages NSFs and monitors the NSFs running in the system, maintaining various information related to each NSF; it searches for the appropriate NSF through the received policies, and after identifying the appropriate NSF, sends the policy to the appropriate NSF through the corresponding interface;

[0023] A vendor management system is used to provide a system for service providers to register their NSFs with the security controller, and to create and delete NSFs without any vendor intervention.

[0024] Furthermore, the intent-driven cloud security service system also includes:

[0025] The network security function module performs network security services according to security policies through software running on middleware or servers, and is provided by security service providers.

[0026] Another object of the present invention is to provide an intent-driven cloud security service method of a cloud security service system, the intent-driven cloud security service method comprising the following steps:

[0027] Step 1: Use a multi-level detection method that combines coarse and fine granularity to collect information related to the network status, and aggregate, analyze and process the collected data; collect network data information in multiple dimensions to fully understand the real-time status of the network.

[0028] Step 2: Based on the processing results of the collected data, modeling and reasoning are performed according to the BDI theory to output the internal business intent; the BDI theory ensures the accuracy of network intent reasoning.

[0029] Step three, extract the key features of intent through entity recognition, construct intent based on the key features of intent, preliminarily quantify some indicators, and then translate the intent into strategy through the intent translation module; convert the abstract network intent into a low-level strategy that can be executed by the network.

[0030] Step 4: Detect conflicts between the new strategy and existing strategies in the system, and resolve conflicts between strategies through conflict resolution and negotiation to ensure the correctness of the strategies executed by the network.

[0031] Step 5: Issue the policy that meets the intent, complete the appropriate policy configuration by querying the policy library, and hand over the policy to the resource orchestration layer for processing; select the appropriate policy to meet the needs of the network intent.

[0032] Step 6: After the policy is sent to the security controller, the controller will search for the appropriate NSF and implement the policy by matching the policy with the security functions of the NSF. This automates the implementation of network policies and quickly provides security services.

[0033] Furthermore, in step three, the key features of the intent include factors such as source address and destination address.

[0034] Further, in step six, if the selected NSF is not activated, the NFV framework will be used to instantiate the NSF, and the security controller will pass the received policy to the instantiated NSF to implement the policy, and provide corresponding security services through the instantiated NSF.

[0035] Further, the NSF instantiation specifically includes:

[0036] (1) When receiving an instantiation request from the security controller, the provider management system searches the mapping table for the VM ID corresponding to the NSF that issued the request;

[0037] (2) Send the VM ID to the VNF management module to instantiate the NSF;

[0038] (3) After receiving the instantiation request, the VNF manager requests permission from the NFV orchestrator to allocate resources to the NSF instance;

[0039] (4) The NFV orchestrator analyzes the request based on the configuration requirements of the virtual resources. If the resources are available, the NFV orchestrator grants permission to the VNF manager.

[0040] (5) After obtaining permission, the VNF manager asks the VIM to allocate resources for the NSF instance;

[0041] (6) The VIM creates an NSF based on the resources to be allocated and the information of the requested NSF instance, and sends the information of the created NSF to the VNF manager;

[0042] (7) The VNF manager notifies the vendor management system about the created NSF, and the vendor management system passes the information to the security controller;

[0043] (8) When the security controller receives the information of the created NSF, it passes the policy to the NSF for policy implementation, and the NSF configures the received policy on its own system.

[0044] Another object of the present invention is to provide a wireless communication system utilizing an intent-driven cloud security service system.

[0045] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to execute the intent-driven cloud security service method.

[0046] Combining all the above technical solutions, the advantages and positive effects of the present invention are as follows: the intent-driven cloud security service system in the present invention provides an automated and virtualized system for security service providers, and provides simple, fast and flexible cloud-based security services according to intent, allowing security service providers to efficiently and flexibly manage the resources of cloud servers (i.e., NSFs) without installing any security equipment and without any expert security knowledge. These services can reduce configuration time and workload, and improve resource utilization of security services. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 is a schematic diagram of the structure of an intent-driven cloud security service system provided by an embodiment of the present invention;

[0049] In the figure: 1. Information collection layer; 2. Intent enabling layer; 3. Resource orchestration layer.

[0050] Figure 2 It is a flow chart of an intent-driven cloud security service method provided by an embodiment of the present invention.

[0051] Figure 3 It is a principle flow chart of NSF instantiation provided by an embodiment of the present invention.

[0052] Figure 4 It is a flow chart for implementing the intent-driven cloud security service method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0054] In view of the problems existing in the prior art, the present invention provides an intent-driven cloud security service system and method, which is described in detail below in conjunction with the accompanying drawings.

[0055] like Figure 1 As shown, the intent-driven cloud security service system provided by the embodiment of the present invention includes: an information collection layer 1, an intent enabling layer 2, and a resource orchestration layer 3.

[0056] Information collection layer 1 uses a combination of coarse and fine granularity detection methods to collect a variety of information, and aggregates and analyzes the collected data;

[0057] Intent enabling layer 2, based on the data processing results and in accordance with the Belief-Desire-Intention (BDI) theory, after obtaining the belief of network intrusion, generates the desire to execute defense security strategies, determines the intention to eliminate network intrusion, and completes intent translation, policy verification, and configuration delivery;

[0058] Resource orchestration layer 3 searches for the appropriate NSF (Network Security Function) through the security controller and implements the policy by matching the policy with the security function of the NSF. According to the security functions of the registered NSFs, one or more NSFs may be selected for policy provisioning. If the selected NSF is not activated, the NSF will be instantiated using the NFV framework and the corresponding security services will be provided through the instantiated NSF.

[0059] like Figure 2 As shown, the intent-driven cloud security service technology provided by the embodiment of the present invention includes the following steps:

[0060] S101: Information collection: A multi-level detection method combining coarse and fine granularity is used to collect information related to the network status, and the collected data is aggregated, analyzed, and processed;

[0061] S102: Intent generation: Based on the processing results of the collected data, modeling and reasoning are performed according to the BDI theory to output the internal business intent;

[0062] S103: Intent translation: Extract key features of intent through entity recognition, including source address, destination address and other factors, construct intent based on these features, preliminarily quantify some indicators, and then translate intent into strategy through the intent translation module;

[0063] S104: Policy verification: Detect conflicts between the new policy and existing policies in the system, and resolve conflicts between policies through conflict resolution and negotiation;

[0064] S105: Configuration delivery: Deliver policies that meet the intent, complete appropriate policy configuration by querying the policy library, and hand over the policy to the resource orchestration layer for processing;

[0065] S106: Policy implementation: After the policy is sent to the security controller, the controller will search for the appropriate NSF and implement the policy by matching the policy with the security functions of the NSF; if the selected NSF is not activated, the NFV framework will be used to instantiate the NSF, and the security controller will pass the received policy to the instantiated NSF to implement the policy and provide corresponding security services through the instantiated NSF.

[0066] like Figure 3 As shown, the NSF instantiation process provided by the embodiment of the present invention includes:

[0067] When receiving an instantiation request from the security controller, the vendor management system searches the mapping table for the virtual machine ID corresponding to the NSF that issued the request; sends the virtual machine ID to the VNF management module to instantiate the NSF; after receiving the instantiation request, the VNF manager requests the NFV orchestrator for permission to allocate resources to the NSF instance; the NFV orchestrator analyzes the request according to the configuration requirements of the virtual resources, and if the resources are available, the NFV orchestrator will grant permission to the VNF manager; after obtaining permission, the VNF manager asks the VIM to allocate resources to the NSF instance; the VIM creates the NSF based on the resources to be allocated and the information of the requested NSF instance, and sends the information of the created NSF to the VNF manager; the VNF manager notifies the vendor management system about the information of the created NSF, and the vendor management system passes the information to the security controller; when the security controller receives the information of the created NSF, it passes the policy to the NSF for policy implementation, and the NSF completes the configuration of the received policy on its own system.

[0068] like Figure 4 As shown, the implementation process of the intent-driven cloud security service method provided by the embodiment of the present invention includes:

[0069] Step 1: A multi-level detection method combining coarse and fine granularity is used to collect network status information. Coarse-grained detection is performed on a large amount of traffic in L1 and L2, and fine-grained detection is performed on a small amount of traffic in L3. The labeled "PreFIX" is part of L1, and by default, it provides header information for the first packet in each flow. At the L1 and L2 layers, sFlow captures traffic information based on sampling, providing potential, continuous online sampling detection; at the L2 layer, it provides finer-grained and continuous detection capabilities based on IPFIX (IP Data Flow Information Output) to detect abnormal traffic that can evade sampling-based detection methods; finally, the L3 layer forwards suspicious traffic to DPI for classification.

[0070] Step 2: Based on multi-level detection, the collected network data information is aggregated, analyzed, and processed. According to the BDI theory, after obtaining the belief of network intrusion, the desire to implement defensive security strategies is generated, and the intention to eliminate network intrusion is determined.

[0071] Step three: extract the key features of intent through entity recognition, construct intent based on the key features of intent, preliminarily quantify some indicators, and then use the intent translation module to convert the intent (for example, blocking malicious IP addresses) into low-level security policies (for example, performing a Drop operation on data packets sent from IP address 192.168.220.135 to social networking sites Facebook and Instagram). After verification, the policies that meet the intent are configured and issued.

[0072] Step 4: After the policy is sent to the security controller, the controller will search for the appropriate NSF and provision the policy by matching the policy with the security functions of the NSF.

[0073] Step 5: After the matching is completed, the selected NSF executes the received policy on its own system and provides corresponding security service functions.

[0074] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0075] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. An intent-driven cloud security service system, characterized in that: The intent-driven cloud security service system includes: The information collection layer is used to collect various types of information using a multi-level detection method that combines coarse and fine granularity, and aggregate, analyze and process the collected data; The intention enabling layer is used to generate the desire to execute defense security strategies after obtaining the belief of network intrusion based on the data processing results and according to the BDI theory, determine the intention to eliminate network intrusion, and complete the intention translation, policy verification, and configuration delivery; The resource orchestration layer is used to search for appropriate NSFs through the security controller, implement policies by matching policies with the security functions of the NSFs, select one or more NSFs for policy provisioning based on the security functions of the registered NSFs, and if the selected NSF is not activated, the NSF will be instantiated using the NFV framework, and the corresponding security services will be provided through the instantiated NSFs; An intent-driven cloud security service method for running the intent-driven cloud security service system, the intent-driven cloud security service method comprising the following steps: Step 1: Use a multi-level detection method that combines coarse and fine granularity to collect information related to the network status, and aggregate, analyze and process the collected data; Step 2: Based on the processing results of the collected data, modeling and reasoning are performed according to the BDI theory to output the internal business graph; Step 3: Extract the key features of intent through entity recognition, construct intent based on the key features, quantify some indicators, and then translate the intent into a strategy through the intent translation module; Step 4: Detect conflicts between the new strategy and existing strategies in the system, and resolve conflicts between strategies through conflict resolution and negotiation; Step 5: Issue the policy that meets the intent, complete the appropriate policy configuration by querying the policy library, and hand over the policy to the resource orchestration layer for processing; Step 6: After the policy is sent to the security controller, the controller will search for the appropriate NSF and implement the policy by matching the policy with the security functions of the NSF; In step 6, if the selected NSF is not activated, the NFV framework will be used to instantiate the NSF, and the security controller will pass the received policy to the instantiated NSF to implement the policy and provide corresponding security services through the instantiated NSF; The NSF instantiation specifically includes: (1) When receiving an instantiation request from the security controller, the provider management system searches the mapping table for the VM ID corresponding to the NSF that issued the request; (2) Send the VM ID to the VNF management module to instantiate the NSF; (3) After receiving the instantiation request, the VNF manager requests permission from the NFV orchestrator to allocate resources to the NSF instance; (4) The NFV orchestrator analyzes the request based on the configuration requirements of the virtual resources. If the resources are available, the NFV orchestrator grants permission to the VNF manager. (5) After obtaining permission, the VNF manager asks the VIM to allocate resources for the NSF instance; (6) The VIM creates an NSF based on the resources to be allocated and the information of the requested NSF instance, and sends the information of the created NSF to the VNF manager; (7) The VNF manager notifies the provider management system about the information of the created NSF, and the provider management system passes the information of the NSF to the security controller; (8) When the security controller receives the information of the created NSF, it passes the policy to the NSF for policy implementation, and the NSF configures the received policy on its own system.

2. The intent-driven cloud security service system according to claim 1, characterized in that: The intent enabling layer includes: The intent translation module is responsible for translating the collected intents and realizing the process from intent to strategy; The policy verification module is responsible for verifying the generated policy. After the policy is generated, the conflict resolution and consistency check module is responsible for resolving conflicts between multiple policies or between new policies and existing policies. At the same time, the user is fed back the results and asked whether the negotiation is acceptable. The configuration delivery module is responsible for delivering specific policies after the requirements are met. It completes the appropriate policy configuration by querying the policy library and submits it to the lower-level resource orchestration layer for processing.

3. The intent-driven cloud security service system according to claim 1, characterized in that: The resource orchestration layer includes: The security controller centrally manages NSFs and monitors the NSFs running in the system, maintaining various information related to each NSF; it searches for the appropriate NSF through the received policies, and after identifying the appropriate NSF, sends the policy to the appropriate NSF through the corresponding interface; A vendor management system is used to provide a system for service providers to register their NSFs with the security controller, and to create and delete NSFs without any vendor intervention.

4. The intent-driven cloud security service system according to claim 1, characterized in that: The intent-driven cloud security service system also includes: The network security function module performs network security services according to security policies through software running on middleware or servers, and is provided by security service providers.

5. The intent-driven cloud security service system according to claim 1, characterized in that: In step three, the key features of the intent include the source address and the destination address.

6. A wireless communication system utilizing the intent-driven cloud security service system according to any one of claims 1 to 5.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the intent-driven cloud security service method of the intent-driven cloud security service system of any one of claims 1 to 5.

Images