SDN-based network orchestration method, apparatus, device, and storage medium

Abstract

Embodiments of the present application provide a network orchestration method and device based on SDN, equipment and storage medium, the method comprises: edge computing orchestration manager (MEO) sends firewall configuration information to a security controller, the firewall configuration information is used for the security controller to automatically create a firewall traffic policy; the router configuration information is sent to the SDN controller through the virtual infrastructure manager (VIM) northbound interface, and the router configuration information is used for the SDN controller to create the docking network between the firewall and the router.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a network orchestration method, apparatus, device and storage medium based on Software Defined Network (SDN). Background Technology

[0002] In edge computing scenarios, the network connectivity resources required by different enterprise third-party APP applications, including the Network and Subnet, vRouter, VPC Connection, etc. created to achieve Layer 3 interconnection, all need to be manually configured with relevant network parameters during the deployment process so that the relevant network connectivity resources are created before the APP is created.

[0003] However, for security reasons, interactions between different services need to be isolated through physical firewalls. On the firewall, traffic policies and rules between various services are configured manually by logging into the device or through the hardware firewall management system. This not only increases the workload of operations and maintenance personnel but also introduces the risk of operational errors. Summary of the Invention

[0004] In view of this, embodiments of this application aim to provide a network orchestration method, apparatus, device, and storage medium based on SDN.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a network orchestration method based on Software-Defined Networking (SDN), which is applied to an Edge Computing Orchestration Manager (MEO). The method includes:

[0007] The firewall configuration information is sent to the security controller, and the firewall configuration information is used by the security controller to automatically create firewall traffic policies.

[0008] Router configuration information is sent to the SDN controller via the Virtual Infrastructure Manager (VIM) northbound interface. This router configuration information is used by the SDN controller to create a network interface between the firewall and the router.

[0009] in,

[0010] The firewall configuration information includes at least: the security configuration requirements of the network to which it is connected; the security configuration requirements include: the firewall policies and firewall rules required for the deployment of the virtual firewall;

[0011] The router configuration information includes at least the attribute information of the virtual router that is associated with and bound to the virtual firewall.

[0012] Before sending the firewall configuration information to the security controller, the method further includes:

[0013] The network configuration template file is parsed, and the instantiated parameters obtained from the parsing are input into the MEO interface; among them,

[0014] The network configuration template file shall include at least the following parameters:

[0015] Firewall policies required for virtual firewall deployment;

[0016] Firewall rules required for virtual firewall deployment;

[0017] The relevant attribute information of the virtual router that is associated with the virtual firewall.

[0018] The traffic management information in the firewall policy includes at least the following:

[0019] Source and destination address information for traffic exchange.

[0020] After sending the router configuration information to the SDN controller via the VIM northbound interface, the method further includes:

[0021] By calling the VIM northbound interface and the security controller northbound interface, a virtual firewall and firewall traffic policies are created, and a network interface is created between the firewall and the router, thus completing network orchestration.

[0022] The step of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes:

[0023] Call the VIM northbound native interface to create an exit virtual route for forwarding VRF;

[0024] Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF;

[0025] Call the northbound logical virtual device creation interface of the security controller to create a virtual firewall vSys;

[0026] Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain;

[0027] The VIM northbound interface is invoked to complete network interconnection between the VRF, the VRF interconnected by the application APP, and the vSys;

[0028] The northbound interface of the security controller is invoked to complete network interconnection between the vSys, the egress VRF, and the VRF interconnected with the APP.

[0029] This application also provides a network orchestration method based on Software-Defined Networking (SDN), the method being applied to an SDN controller, the method comprising:

[0030] Receive router configuration information sent by MEO through the northbound interface of Virtual Infrastructure Manager (VIM);

[0031] Based on the router configuration information, create a network connecting the firewall and the router.

[0032] The step of creating a network between the firewall and the router based on the router configuration information includes:

[0033] Determine the relevant attribute information of the virtual router that is associated with and bound to the virtual firewall in the router configuration information;

[0034] The virtual router's corresponding egress virtual route is created via the VIM northbound native interface to forward the VRF;

[0035] The logical sub-interface of the VRF is created through the VIM northbound interconnect link creation interface;

[0036] Network communication between the VRF, the VRF interconnected with the application APP, and the virtual firewall vSys is achieved through the VIM northbound interface.

[0037] This application also provides a network orchestration method based on Software-Defined Networking (SDN), the method being applied to a security controller, the method comprising:

[0038] Receive firewall configuration information sent by MEO;

[0039] Firewall traffic policies are automatically created based on the firewall configuration information.

[0040] The automatic creation of firewall traffic policies based on the firewall configuration information includes:

[0041] Determine the firewall policies and rules required for the virtual firewall deployment in the firewall configuration information;

[0042] Configure the traffic policy of the virtual firewall on the hardware firewall based on the firewall policies and rules required for the deployment of the virtual firewall.

[0043] The step of configuring the traffic policy of the virtual firewall on the hardware firewall includes:

[0044] Create a virtual firewall vSys through the northbound logical virtual device creation interface of the security controller;

[0045] Create a logical sub-interface of the vSys through the northbound device creation interface of the security controller, and associate it with the specified security domain;

[0046] Network interconnection between vSys and the VRF interconnected with the egress VRF and APP is achieved through the northbound interface of the security controller.

[0047] This application also provides a network orchestration apparatus based on Software-Defined Networking (SDN), comprising: a first communication unit and a first processing unit; wherein...

[0048] The first communication unit is used to send firewall configuration information to the security controller, the firewall configuration information being used by the security controller to automatically create firewall traffic policies; and to send router configuration information to the SDN controller through the Virtual Infrastructure Manager (VIM) northbound interface, the router configuration information being used by the SDN controller to create a network interface between the firewall and the router.

[0049] This application also provides a network orchestration device based on Software-Defined Networking (SDN), comprising: a second communication unit and a second processing unit; wherein...

[0050] The second communication unit is used to receive router configuration information sent by MEO through the Virtual Infrastructure Manager (VIM) northbound interface;

[0051] The second processing unit is used to create a network connection between the firewall and the router based on the router configuration information.

[0052] This application also provides a network orchestration apparatus based on Software-Defined Networking (SDN), comprising: a third communication unit and a third processing unit; wherein...

[0053] The third communication unit is used to receive firewall configuration information sent by MEO;

[0054] The third processing unit is used to automatically create firewall traffic policies based on the firewall configuration information.

[0055] This application also provides a MEO, including: a first communication interface and a first processor; wherein,

[0056] The first communication interface is used to send firewall configuration information to the security controller, and the firewall configuration information is used by the security controller to automatically create firewall traffic policies; the router configuration information is sent to the SDN controller through the Virtual Infrastructure Manager (VIM) northbound interface, and the router configuration information is used by the SDN controller to create a network interface between the firewall and the router.

[0057] This application also provides an SDN controller, including: a second communication interface and a second processor; wherein,

[0058] The second communication interface is used to receive router configuration information sent by MEO through the Virtual Infrastructure Manager (VIM) northbound interface;

[0059] The second processor is used to create a network interface between the firewall and the router based on the router configuration information.

[0060] This application also provides a security controller, including: a third communication interface and a third processor; wherein,

[0061] The third communication interface is used to receive firewall configuration information sent by MEO;

[0062] The third processor is used to automatically create firewall traffic policies based on the firewall configuration information.

[0063] This application also provides a MEO, including: a first processor and a first memory for storing a computer program capable of running on the processor.

[0064] Wherein, when the first processor is used to run the computer program, it executes the steps of the above method.

[0065] This application also provides an SDN controller, including: a second processor and a second memory for storing a computer program capable of running on the processor.

[0066] The second processor is used to execute the steps of the above method when running the computer program.

[0067] This application also provides a security controller, including: a third processor and a third memory for storing a computer program capable of running on the processor.

[0068] The third processor is used to execute the steps of the above method when running the computer program.

[0069] This application also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the above-described method.

[0070] The SDN-based network orchestration method, apparatus, device, and storage medium provided in this application embodiment include an Edge Computing Orchestration Manager (MEO) that sends firewall configuration information to a security controller. This firewall configuration information is used by the security controller to automatically create firewall traffic policies. Router configuration information is sent to an SDN controller via the Virtual Infrastructure Manager (VIM) northbound interface. This router configuration information is used by the SDN controller to create the network interface between the firewall and the router. Through orchestration management of the security controller and the SDN controller, the MEO in this application embodiment achieves automatic creation of (virtual) firewalls, reducing the workload of operations and maintenance personnel and greatly avoiding system problems caused by operator errors. Attached Figure Description

[0071] Figure 1 This is a schematic flowchart of the SDN-based network orchestration method described in the embodiments of this application. Figure 1 ;

[0072] Figure 2 This is a schematic diagram of the network edge cloud system architecture that integrates SDN as described in the embodiments of this application;

[0073] Figure 3 This is a schematic diagram illustrating the third-party APP application and enterprise park business scenario described in the embodiments of this application;

[0074] Figure 4 This is a schematic diagram of the SDN-based network orchestration process described in the embodiments of this application;

[0075] Figure 5 This is a schematic flowchart of the SDN-based network orchestration method described in the embodiments of this application. Figure 2 ;

[0076] Figure 6 This is a schematic flowchart of the SDN-based network orchestration method described in the embodiments of this application. Figure 3 ;

[0077] Figure 7 This is a schematic diagram of the SDN-based network orchestration device structure described in the embodiments of this application. Figure 1 ;

[0078] Figure 8 This is a schematic diagram of the SDN-based network orchestration device structure described in the embodiments of this application. Figure 2 ;

[0079] Figure 9 This is a schematic diagram of the SDN-based network orchestration device structure described in the embodiments of this application. Figure 3 ;

[0080] Figure 10 This is a schematic diagram of the MEO structure described in the embodiments of this application;

[0081] Figure 11 This is a schematic diagram of the SDN controller structure described in an embodiment of this application;

[0082] Figure 12 This is a schematic diagram of the safety controller structure described in an embodiment of this application. Detailed Implementation

[0083] The present application will now be described in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other. The present application will now be described in detail with reference to the accompanying drawings and embodiments.

[0084] This application provides an SDN-based network orchestration method, such as... Figure 1 As shown, the method is applied to an edge computing orchestration manager (MEO), and the method includes:

[0085] Step 101: Send the firewall configuration information to the security controller, the firewall configuration information being used by the security controller to automatically create firewall traffic policies;

[0086] Step 102: Send the router configuration information to the SDN controller via the Virtual Infrastructure Manager (VIM) northbound interface. The router configuration information is used by the SDN controller to create a network interface between the firewall and the router.

[0087] In this embodiment, the firewall includes a virtual firewall deployed on a hardware firewall. In practical applications, firewall resources can be fully utilized to create multiple virtual firewalls (vFWs) on the hardware firewall, which then hosts these virtual firewalls. The MEO interface with the security controller enables automated creation of firewall traffic policies. The MEO interface with the VIM (SDN controller), which creates a network between the firewall and the router, enabling bidirectional management of traffic policies.

[0088] In the embodiments of this application,

[0089] The firewall configuration information includes at least: the security configuration requirements of the network to which it is connected; the security configuration requirements include: the firewall policies and firewall rules required for the deployment of the virtual firewall;

[0090] The router configuration information includes at least the attribute information of the virtual router that is associated with and bound to the virtual firewall.

[0091] In this embodiment of the application, before sending the firewall configuration information to the security controller, the method further includes:

[0092] The network configuration template file is parsed, and the instantiated parameters obtained from the parsing are input into the MEO interface; among them,

[0093] The network configuration template file shall include at least the following parameters:

[0094] Firewall policies required for virtual firewall deployment;

[0095] Firewall rules required for virtual firewall deployment;

[0096] The relevant attribute information of the virtual router that is associated with the virtual firewall.

[0097] In this embodiment of the application, the traffic management information in the firewall policy includes at least:

[0098] Source and destination address information for traffic exchange.

[0099] In one embodiment, Table 1 below shows the relevant parameters for the traffic exchange template between a third-party app and an enterprise campus. By defining the parameters `Router_ref` and `Firewall_policy`, the firewall policy is bound to the virtual router (vRouter). The traffic management information in the firewall policy includes: the source address information (IP address, port number) and destination address information (IP address, port number) for the traffic exchange. For example, if app_1 needs to access enterprise campus 1, and the vRouter connected to app_1 is "vRouter-1", while the vRouter connected to enterprise campus 1 is "vRouter-2", then two traffic policies need to be configured to achieve bidirectional traffic exchange between app_1 and enterprise campus 1. Through the configuration described above, the virtual firewall (vFirewall_1) on the hardware firewall has added the traffic configuration information required for bidirectional communication between app_1 and enterprise campus 1, allowing them to exchange traffic.

[0100]

[0101] Table 1

[0102] After the above configuration, the edge MEO first parses the network configuration template file, extracting the relevant firewall policies, firewall rules, and vRouter parameters and attributes required for the deployment of the virtual firewall. Then, the MEO interface inputs the extracted attribute parameters for instantiation. Next, the MEO calls the northbound interface of VIM and the northbound interface of the security controller to create the virtual firewall instance, create the virtual firewall policy configuration, and create and distribute the relevant routing information.

[0103] In one embodiment of this application, the network edge cloud system architecture integrating SDN is as follows: Figure 2 As shown, an SDN controller and a security controller are introduced on top of the existing standard NFV three-layer, one-domain architecture. The SDN controller interfaces northward with the VIM to obtain internal and external network configuration requirements for the resource pool, and southward with forwarding devices to distribute network configurations, thus building a unified resource pool. The security controller interfaces northward with the MEO to obtain network and security configuration requirements, and southward with the FW to abstract the model and distribute configurations. After introducing SDN into the network edge cloud, only one VIM and SDN controller are deployed within a single resource pool. The security controller is deployed at the provincial level, managing the FWs of multiple resource pools. The MEO distributes orchestrated network requirements through the northward interface of the VIM. The SDN plugin installed within the VIM interfaces with the SDN controller, distributing upper-layer network requirements to the SDN controller, which then enables centralized management, dynamic adjustment, and unified operation and maintenance of the resource pool network.

[0104] In practical applications, city-level shared and park resource pools primarily target B2B businesses, deploying third-party apps from various enterprises within the resource pool. Traffic exchange between these third-party apps within the edge cloud and enterprise parks requires the coordinated operation of devices such as MEO, SDN controllers, security controllers, and firewalls, along with an end-to-end network orchestration solution. This enables automatic network access and dynamic adjustment from the resource pool to the enterprise park environment. Figure 3 As shown, the external network includes networks such as the data center's connection to the campus, SPN, and CMNET. This external network needs to be dynamically deployed along with leased lines and enterprise business operations. Therefore, the 2B network edge cloud has a greater need for automated external network egress compared to the network cloud. Each enterprise within the edge cloud is securely isolated. With the dynamic deployment of business operations, the edge cloud not only requires automated security policies but also automated gateway (GW) and firewall (FW) network connections. Since the APP and enterprise business belong to the DMZ domain, traffic exchange needs to be controlled securely through the FW. Therefore, dynamic routing between the DC-GW and FW needs to be supported.

[0105] In this embodiment of the application, after sending the router configuration information to the SDN controller via the VIM northbound interface, the method further includes:

[0106] By calling the VIM northbound interface and the security controller northbound interface, a virtual firewall and firewall traffic policies are created, and a network interface is created between the firewall and the router, thus completing network orchestration.

[0107] In one embodiment, the step of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating an interface network between the firewall and the router, includes:

[0108] Call the VIM northbound native interface to create an exit virtual route for forwarding VRF;

[0109] Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF;

[0110] Call the security controller's northbound logical virtual device creation interface (CreateLogicVirtualDevice) to create a virtual firewall vSys;

[0111] Call the security controller's northbound device creation interface (CreateDeviceInterface) to create the logical sub-interface of the vSys and associate it with the specified security domain;

[0112] The VIM northbound interface is invoked to complete network interconnection between the VRF, the VRF interconnected by the application APP, and the vSys;

[0113] The northbound interface of the security controller is invoked to complete network interconnection between the vSys, the egress VRF, and the VRF interconnected with the APP.

[0114] In one embodiment, such as Figure 4 As shown, the SDN-based network orchestration process includes:

[0115] Prerequisites: The network configuration template has been user-defined and imported into MEO. Firewall tenants have been created, and operators have the relevant firewall tenant permissions.

[0116] Step 1: On the MEO interface, the operator selects a specified network configuration template to trigger the "APP to Enterprise Park Traffic Model" activation operation;

[0117] Step 2: MEO calls the VIM northbound native interface to create an exit VRF (e.g., VRF_APP_1_SPN_ex) that is interconnected with the SPN;

[0118] Step 3: MEO calls the VIM northbound interconnection link creation interface to create logical sub-interfaces for VRF, which are used for VRF to communicate with vSys and VRF to communicate with external CE (e.g., including the VRF_APP_1_SPN_ex and vSys interconnection interface, the VRF_APP_1 and vSys interconnection interface, and the VRF_APP_1_SPN_ex and external CE interconnection interface).

[0119] Step 4: MEO calls the CreateLogicVirtualDevice interface of the security controller to create a virtual firewall vSys (e.g., vSys_ex_APP_1) (This condition is required; if vSys has already been created, it can be referenced directly).

[0120] Step 5: MEO calls the CreateDeviceInterface interface of the security controller to create the above vSys logical sub-interface and associate it with the specified security domain (e.g., untrust2 and DMZ);

[0121] Step 6: MEO calls the VIM northbound interface to complete network communication between the VRF and vSys for VRF and APP interconnection, including:

[0122] Static route creation between APP interconnection VRF (e.g., VRF_APP_1) and vSys (e.g., vSys_ex_APP_1);

[0123] Create BGP neighbor, BGP import routing information and routing policy information between the outgoing VRF (e.g., VRF_APP_1_SPN_ex) and vSys (e.g., vSys_ex_APP_1);

[0124] Between the outgoing VRF (e.g., VRF_APP_1_SPN_ex) and the external CE, BGP neighbors, OSPF, static routes, and BFD sessions are established according to the user's selection.

[0125] Step 7: MEO calls the northbound interface of the security controller to complete network interconnection between vSys, the egress VRF, and the APP interconnection VRF, including:

[0126] Static routes are created between vSys (e.g., vSys_ex_APP_1) and the APP interconnect VRF (e.g., VRF_APP_1);

[0127] Creation of BGP peers, BGP address families, and routing policies between vSys (e.g., vSys_ex_APP_1) and VRF (e.g., VRF_APP_1_SPN_ex).

[0128] Step 8: MEO returns the operation result.

[0129] The creation of each interface in the above process is shown below:

[0130] 1. Create a VRF interface

[0131] Interface Overview: To address the need for northbound interconnection between the MEC resource pool and the SPN, the MEO calls the VRF to create an interface and create a virtual forwarding device object.

[0132] The API interface is shown in Table 2:

[0133]

[0134] Table 2

[0135] The parameter definitions are shown in Table 3:

[0136]

[0137] Table 3

[0138] Status return code: If the execution is successful, a status code of 202 is returned; if the execution fails, a status code of 404 is returned.

[0139] 2. Create interconnection link interfaces

[0140] Interface Overview: To address the need for interconnection between MEC resource pool routers and SPN and firewall vsys, MEO calls the VIM interconnection link creation interface to create logical sub-interfaces on the virtual forwarding device object.

[0141] The API interface is shown in Table 4:

[0142]

[0143] Table 4

[0144] The parameter definitions are shown in Table 5:

[0145]

[0146]

[0147]

[0148] Table 5

[0149] 3. Create a virtual firewall vsys interface

[0150] Interface Overview: To address the need for interconnection between MEC resource pool routers and firewall vsys, MEO calls the northbound virtual firewall vsys creation interface of firewall controller SC to create the virtual firewall vsys.

[0151] The API interface is shown in Table 6:

[0152]

[0153] Table 6

[0154] The parameter definitions are shown in Table 7:

[0155]

[0156]

[0157] Table 7

[0158] Status return codes: If the execution is successful, the status code is 201; if the parameter is incorrect, the status code is 400; if there is an internal error, the status code is 500; if the configuration name is duplicated, the status code is 409.

[0159] 4. Create a virtual firewall interface.

[0160] Interface Overview: To address the need for interconnection between MEC resource pool routers and firewall vsys, MEO calls the northbound virtual firewall vsys interface of firewall controller SC to create a virtual interface for the virtual firewall vsys.

[0161] The API interface is shown in Table 8:

[0162]

[0163] Table 8

[0164] The parameter definitions are shown in Table 9:

[0165]

[0166]

[0167]

[0168]

[0169] Table 9

[0170] Status return codes: If the execution is successful, the status code is 201; if the parameter is incorrect, the status code is 400; if there is an internal error, the status code is 500; if the configuration name is duplicated, the status code is 409.

[0171] This application also provides an SDN-based network orchestration method, such as... Figure 5 As shown, the method is applied to an SDN controller, and the method includes:

[0172] Step 501: Receive router configuration information sent by MEO through the Virtual Infrastructure Manager (VIM) northbound interface;

[0173] Step 502: Create a network between the firewall and the router based on the router configuration information.

[0174] In this embodiment of the application, the step of creating an interconnected network between the firewall and the router based on the router configuration information includes:

[0175] Determine the relevant attribute information of the virtual router that is associated with and bound to the virtual firewall in the router configuration information;

[0176] The virtual router's corresponding egress virtual route is created via the VIM northbound native interface to forward the VRF;

[0177] The logical sub-interface of the VRF is created through the VIM northbound interconnect link creation interface;

[0178] Network communication between the VRF, the VRF interconnected with the application APP, and the virtual firewall vSys is achieved through the VIM northbound interface.

[0179] This application also provides an SDN-based network orchestration method, such as... Figure 6 As shown, the method is applied to a security controller, and the method includes:

[0180] Step 601: Receive firewall configuration information sent by MEO;

[0181] Step 602: Automatically create firewall traffic policies based on the firewall configuration information.

[0182] In this embodiment of the application, the automatic creation of firewall traffic policies based on the firewall configuration information includes:

[0183] Determine the firewall policies and rules required for the virtual firewall deployment in the firewall configuration information;

[0184] Configure the traffic policy of the virtual firewall on the hardware firewall based on the firewall policies and rules required for the deployment of the virtual firewall.

[0185] In this embodiment of the application, configuring the traffic policy of the virtual firewall on the hardware firewall includes:

[0186] Create a virtual firewall vSys using the CreateLogicVirtualDevice interface of the security controller's northbound logical virtual device creation interface;

[0187] Create the logical sub-interface of the vSys through the CreateDeviceInterface interface of the security controller northbound device, and associate it with the specified security domain;

[0188] Network interconnection between vSys and the VRF interconnected with the egress VRF and APP is achieved through the northbound interface of the security controller.

[0189] To implement the MEO-side method of this application embodiment, this application embodiment also provides an SDN-based network orchestration device, such as... Figure 7 As shown, it includes: a first communication unit 701 and a first processing unit 702; wherein,

[0190] The first communication unit 701 is used to send firewall configuration information to the security controller, the firewall configuration information being used by the security controller to automatically create firewall traffic policies; and to send router configuration information to the SDN controller through the Virtual Infrastructure Manager (VIM) northbound interface, the router configuration information being used by the SDN controller to create a network interface between the firewall and the router.

[0191] In the embodiments of this application,

[0192] The firewall configuration information includes at least: the security configuration requirements of the network to which it is connected; the security configuration requirements include: the firewall policies and firewall rules required for the deployment of the virtual firewall;

[0193] The router configuration information includes at least the attribute information of the virtual router that is associated with and bound to the virtual firewall.

[0194] In this embodiment of the application, before the first communication unit 701 sends the firewall configuration information to the security controller, the first processing unit 702 is used to...

[0195] The network configuration template file is parsed, and the instantiated parameters obtained from the parsing are input into the MEO interface; among them,

[0196] The network configuration template file shall include at least the following parameters:

[0197] Firewall policies required for virtual firewall deployment;

[0198] Firewall rules required for virtual firewall deployment;

[0199] The relevant attribute information of the virtual router that is associated with the virtual firewall.

[0200] In this embodiment of the application, the traffic management information in the firewall policy includes at least:

[0201] Source and destination address information for traffic exchange.

[0202] In this embodiment of the application, after the first communication unit 701 sends the router configuration information to the SDN controller through the VIM northbound interface, it is also used for

[0203] By calling the VIM northbound interface and the security controller northbound interface, a virtual firewall and firewall traffic policies are created, and a network interface is created between the firewall and the router, thus completing network orchestration.

[0204] In this embodiment, the first communication unit 701 creates a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creates a network interface between the firewall and the router, including:

[0205] Call the VIM northbound native interface to create an exit virtual route for forwarding VRF;

[0206] Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF;

[0207] Call the CreateLogicVirtualDevice interface of the security controller to create a virtual firewall vSys;

[0208] Call the CreateDeviceInterface interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain;

[0209] The VIM northbound interface is invoked to complete network interconnection between the VRF, the VRF interconnected by the application APP, and the vSys;

[0210] The northbound interface of the security controller is invoked to complete network interconnection between the vSys, the egress VRF, and the VRF interconnected with the APP.

[0211] In practical applications, the first communication unit 701 can be implemented by the communication interface in the SDN-based network orchestration device; the first processing unit 702 can be implemented by the processor in the SDN-based network orchestration device.

[0212] It should be noted that the SDN-based network orchestration device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0213] To implement the SDN controller-side method of this application embodiment, this application embodiment also provides an SDN-based network orchestration device, such as... Figure 8 As shown, it includes: a second communication unit 801 and a second processing unit 802; wherein,

[0214] The second communication unit 801 is used to receive router configuration information sent by MEO through the Virtual Infrastructure Manager (VIM) northbound interface;

[0215] The second processing unit 802 is used to create a network between the firewall and the router based on the router configuration information.

[0216] In this embodiment of the application, the second processing unit 802 creates a network connecting the firewall and the router based on the router configuration information, including:

[0217] Determine the relevant attribute information of the virtual router that is associated with and bound to the virtual firewall in the router configuration information;

[0218] The virtual router's corresponding egress virtual route is created via the VIM northbound native interface to forward the VRF;

[0219] The logical sub-interface of the VRF is created through the VIM northbound interconnect link creation interface;

[0220] Network communication between the VRF, the VRF interconnected with the application APP, and the virtual firewall vSys is achieved through the VIM northbound interface.

[0221] In practical applications, the second communication unit 801 can be implemented by the communication interface in the SDN-based network orchestration device; the second processing unit 802 can be implemented by the processor in the SDN-based network orchestration device.

[0222] It should be noted that the SDN-based network orchestration device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0223] To implement the method on the security controller side of this application embodiment, this application embodiment also provides an SDN-based network orchestration device, such as... Figure 9 As shown, it includes: a third communication unit 901 and a third processing unit 902; wherein,

[0224] The third communication unit 901 is used to receive firewall configuration information sent by MEO;

[0225] The third processing unit 902 is used to automatically create firewall traffic policies based on the firewall configuration information.

[0226] In this embodiment of the application, the third processing unit 902 automatically creates a firewall traffic policy based on the firewall configuration information, including:

[0227] Determine the firewall policies and rules required for the virtual firewall deployment in the firewall configuration information;

[0228] Configure the traffic policy of the virtual firewall on the hardware firewall based on the firewall policies and rules required for the deployment of the virtual firewall.

[0229] In this embodiment of the application, the third processing unit 902 configures the traffic policy of the virtual firewall on the hardware firewall, including:

[0230] Create a virtual firewall vSys using the CreateLogicVirtualDevice interface of the security controller's northbound logical virtual device creation interface;

[0231] Create the logical sub-interface of the vSys through the CreateDeviceInterface interface of the security controller northbound device, and associate it with the specified security domain;

[0232] Network interconnection between vSys and the VRF interconnected with the egress VRF and APP is achieved through the northbound interface of the security controller.

[0233] In practical applications, the third communication unit 901 can be implemented by the communication interface in the SDN-based network orchestration device; the third processing unit 902 can be implemented by the processor in the SDN-based network orchestration device.

[0234] It should be noted that the SDN-based network orchestration device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0235] Based on the hardware implementation of the above program modules, and in order to implement the MEO-side method of the embodiments of this application, the embodiments of this application also provide an MEO, such as... Figure 10 As shown, the MEO 1000 includes:

[0236] The first communication interface 1001 is capable of exchanging information with the security controller and / or other nodes on the network side;

[0237] The first processor 1002 is connected to the first communication interface 1001 to enable information interaction with the security controller and / or other nodes on the network side, and to execute the methods provided by one or more technical solutions on the MEO side when running a computer program;

[0238] The computer program is stored in the first memory 1003.

[0239] Specifically, the first communication interface 1001 is used to send firewall configuration information to the security controller, the firewall configuration information being used by the security controller to automatically create firewall traffic policies; and to send router configuration information to the SDN controller through the Virtual Infrastructure Manager (VIM) northbound interface, the router configuration information being used by the SDN controller to create a network interface between the firewall and the router.

[0240] In the embodiments of this application,

[0241] The firewall configuration information includes at least: the security configuration requirements of the network to which it is connected; the security configuration requirements include: the firewall policies and firewall rules required for the deployment of the virtual firewall;

[0242] The router configuration information includes at least the attribute information of the virtual router that is associated with and bound to the virtual firewall.

[0243] In this embodiment of the application, before the first communication interface 1001 sends the firewall configuration information to the security controller, the first processor 1002 is used for

[0244] The network configuration template file is parsed, and the instantiated parameters obtained from the parsing are input into the MEO interface; among them,

[0245] The network configuration template file shall include at least the following parameters:

[0246] Firewall policies required for virtual firewall deployment;

[0247] Firewall rules required for virtual firewall deployment;

[0248] The relevant attribute information of the virtual router that is associated with the virtual firewall.

[0249] In this embodiment of the application, the traffic management information in the firewall policy includes at least:

[0250] Source and destination address information for traffic exchange.

[0251] In this embodiment of the application, after the first communication interface 1001 sends the router configuration information to the SDN controller through the VIM northbound interface, it is also used for

[0252] By calling the VIM northbound interface and the security controller northbound interface, a virtual firewall and firewall traffic policies are created, and a network interface is created between the firewall and the router, thus completing network orchestration.

[0253] In this embodiment, the first communication interface 1001 creates a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creates a network interface between the firewall and the router, including:

[0254] Call the VIM northbound native interface to create an exit virtual route for forwarding VRF;

[0255] Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF;

[0256] Call the CreateLogicVirtualDevice interface of the security controller to create a virtual firewall vSys;

[0257] Call the CreateDeviceInterface interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain;

[0258] The VIM northbound interface is invoked to complete network interconnection between the VRF, the VRF interconnected by the application APP, and the vSys;

[0259] The northbound interface of the security controller is invoked to complete network interconnection between the vSys, the egress VRF, and the VRF interconnected with the APP.

[0260] It should be noted that the specific processing procedures of the first communication interface 1001 and the first processor 1002 can be understood by referring to the above method, and will not be repeated here.

[0261] Of course, in practical applications, the various components in the MEO 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to implement communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 10 The general labeled all buses as Bus System 1004.

[0262] The first memory 1003 in this embodiment is used to store various types of data to support the operation of the MEO 1000. Examples of such data include any computer program used to operate on the MEO 1000.

[0263] The methods disclosed in the embodiments of this application can be applied to the first processor 1002, or implemented by the first processor 1002. The first processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 1002. The first processor 1002 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 1002 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 1003. The first processor 1002 reads the information in the first memory 1003 and completes the steps of the aforementioned method in combination with its hardware.

[0264] In an exemplary embodiment, the MEO 1000 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned methods.

[0265] Based on the hardware implementation of the above program modules, and in order to implement the SDN controller-side method of this application embodiment, this application embodiment also provides an SDN controller, such as... Figure 11 As shown, the SDN controller 1100 includes:

[0266] The second communication interface 1101 is capable of exchanging information with the terminal MEO and / or other nodes on the network side;

[0267] The second processor 1102 is connected to the second communication interface 1101 to enable information interaction with MEO and / or other nodes on the network side, and to execute the methods provided by one or more technical solutions on the SDN controller side when running computer programs;

[0268] The computer program is stored in the second memory 1103.

[0269] Specifically, the second communication interface 1101 is used to receive router configuration information sent by MEO through the Virtual Infrastructure Manager (VIM) northbound interface;

[0270] The second processor 1102 is used to create a network between the firewall and the router based on the router configuration information.

[0271] In this embodiment of the application, the second processor 1102 creates a network connecting the firewall and the router based on the router configuration information, including:

[0272] Determine the relevant attribute information of the virtual router that is associated with and bound to the virtual firewall in the router configuration information;

[0273] The virtual router's corresponding egress virtual route is created via the VIM northbound native interface to forward the VRF;

[0274] The logical sub-interface of the VRF is created through the VIM northbound interconnect link creation interface;

[0275] Network communication between the VRF, the VRF interconnected with the application APP, and the virtual firewall vSys is achieved through the VIM northbound interface.

[0276] It should be noted that the specific processing procedures of the second communication interface 1101 and the second processor 1102 can be understood by referring to the above method, and will not be repeated here.

[0277] Of course, in practical applications, the various components in the SDN controller 1100 are coupled together through the bus system 1104. It can be understood that the bus system 1104 is used to implement communication between these components. In addition to the data bus, the bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 11 The general designated all buses as Bus System 1104.

[0278] The second memory 1103 in this embodiment is used to store various types of data to support the operation of the SDN controller 1100. Examples of such data include any computer program used to operate on the SDN controller 1100.

[0279] The methods disclosed in the above embodiments of this application can be applied to, or implemented by, the second processor 1102. The second processor 1102 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware or by instructions in the form of software within the second processor 1102. The second processor 1102 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1102 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically a second memory 1103. The second processor 1102 reads information from the second memory 1103 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0280] In an exemplary embodiment, the SDN controller 1100 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned methods.

[0281] Based on the hardware implementation of the above program modules, and in order to implement the method on the security controller side of the embodiments of this application, the embodiments of this application also provide a security controller, such as... Figure 12 As shown, the safety controller 1200 includes:

[0282] The third communication interface 1201 is capable of exchanging information with MEO and / or other nodes on the network side;

[0283] The third processor 1202 is connected to the third communication interface 1201 to enable information interaction with MEO and / or other nodes on the network side, and to execute the methods provided by one or more technical solutions on the security controller side when running computer programs;

[0284] The computer program is stored in the third memory 1203.

[0285] Specifically, the third communication interface 1201 is used to receive firewall configuration information sent by MEO;

[0286] The third processor 1202 is used to automatically create firewall traffic policies based on the firewall configuration information.

[0287] In this embodiment of the application, the third processor 1202 automatically creates firewall traffic policies based on the firewall configuration information, including:

[0288] Determine the firewall policies and rules required for the virtual firewall deployment in the firewall configuration information;

[0289] Configure the traffic policy of the virtual firewall on the hardware firewall based on the firewall policies and rules required for the deployment of the virtual firewall.

[0290] In this embodiment of the application, the third processor 1202 configures the traffic policy of the virtual firewall on the hardware firewall, including:

[0291] Create a virtual firewall vSys using the CreateLogicVirtualDevice interface of the security controller's northbound logical virtual device creation interface;

[0292] Create the logical sub-interface of the vSys through the CreateDeviceInterface interface of the security controller northbound device, and associate it with the specified security domain;

[0293] Network interconnection between vSys and the VRF interconnected with the egress VRF and APP is achieved through the northbound interface of the security controller.

[0294] It should be noted that the specific processing procedures of the third communication interface 1201 and the third processor 1202 can be understood by referring to the above method, and will not be repeated here.

[0295] Of course, in practical applications, the various components in the safety controller 1200 are coupled together via the bus system 1204. It can be understood that the bus system 1204 is used to implement communication between these components. In addition to the data bus, the bus system 1204 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 12 The general designated all buses as Bus System 1204.

[0296] The third memory 1203 in this embodiment is used to store various types of data to support the operation of the security controller 1200. Examples of such data include any computer program used to operate on the security controller 1200.

[0297] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the third processor 1202. The third processor 1202 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware or by instructions in the software form of the third processor 1202. The third processor 1202 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The third processor 1202 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically a third memory 1203. The third processor 1202 reads information from the third memory 1203 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0298] In an exemplary embodiment, the safety controller 1200 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0299] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a first memory 1003 storing a computer program, which can be executed by the first processor 1002 of MEO 1000 to complete the steps described in the aforementioned MEO-side method. Another example is a second memory 1103 storing a computer program, which can be executed by the second processor 1102 of SDN controller 1100 to complete the steps described in the aforementioned SDN controller-side method. Yet another example is a third memory 1203 storing a computer program, which can be executed by the third processor 1202 of security controller 1200 to complete the steps described in the aforementioned security controller-side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0300] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0301] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0302] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A network orchestration method based on Software-Defined Networking (SDN), characterized in that, The method is applied to the Edge Computing Orchestration Manager (MEO), and the method includes: The firewall configuration information is sent to the security controller, and the firewall configuration information is used by the security controller to automatically create firewall traffic policies. Router configuration information is sent to the SDN controller via the Virtual Infrastructure Manager (VIM) northbound interface. This router configuration information is used by the SDN controller to create an interconnection network between the firewall and the router. The interconnection network between the firewall and the router includes a bidirectional network between the egress Virtual Router Forwarding (VRF), the application interconnection (APP) VRF, and the virtual firewall (vSys). The egress Virtual Router Forwarding (VRF) is used to connect to external networks. After sending the router configuration information to the SDN controller via the Virtual Infrastructure Manager (VIM) northbound interface, the method further includes: By calling the VIM northbound interface and the security controller northbound interface, a virtual firewall and firewall traffic policies are created, and a network is created to connect the firewall and the router, thus completing the network orchestration. The process of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

2. The method according to claim 1, characterized in that, The firewall configuration information includes at least: the security configuration requirements of the network to which it is connected; the security configuration requirements include: the firewall policies and firewall rules required for the deployment of the virtual firewall; The router configuration information includes at least the attribute information of the virtual router that is associated with and bound to the virtual firewall.

3. The method according to claim 1, characterized in that, Before sending the firewall configuration information to the security controller, the method further includes: The network configuration template file is parsed, and the instantiated parameters obtained from the parsing are input into the MEO interface; among them, The network configuration template file shall include at least the following parameters: Firewall policies required for virtual firewall deployment; Firewall rules required for virtual firewall deployment; The relevant attribute information of the virtual router that is associated with the virtual firewall.

4. The method according to claim 3, characterized in that, The traffic management information in the firewall policy includes at least: Source and destination address information for traffic exchange.

5. A network orchestration method based on Software-Defined Networking (SDN), characterized in that, The method is applied to an SDN controller, and the method includes: Receive router configuration information sent by MEO through the northbound interface of Virtual Infrastructure Manager (VIM); Based on the router configuration information, an interconnection network is created between the firewall and the router; the interconnection network between the firewall and the router includes: a bidirectional network between the egress virtual route forwarding (VRF), the application APP interconnection VRF, and the virtual firewall vSys; the egress virtual route forwarding (VRF) is used to connect to external networks; In this process, after the MEO sends the router configuration information to the SDN controller through the VIM northbound interface, it also creates a virtual firewall and firewall traffic policy by calling the VIM northbound interface and the security controller northbound interface, and creates a network between the firewall and the router to complete the network orchestration. The process of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

6. The method according to claim 5, characterized in that, The process of creating a network connection between the firewall and the router based on the router configuration information includes: Determine the relevant attribute information of the virtual router that is associated with and bound to the virtual firewall in the router configuration information; The virtual router's corresponding egress virtual route is created via the VIM northbound native interface to forward the VRF; The logical sub-interface of the VRF is created through the VIM northbound interconnect link creation interface; The network interconnection between the VRF for outbound virtual routing and forwarding, the VRF interconnected by the APP, and the vSys is completed through the VIM northbound interface.

7. A network orchestration method based on Software-Defined Networking (SDN), characterized in that, The method is applied to a security controller, and the method includes: Receive firewall configuration information sent by MEO; Firewall traffic policies are automatically created based on the firewall configuration information. The security controller is also used to enable network communication between the firewall and the router; the network between the firewall and the router includes: a bidirectional network between the egress virtual route forwarding (VRF), the application APP interconnection VRF, and the virtual firewall vSys; the egress virtual route forwarding (VRF) is used to connect to external networks; In this process, after the MEO sends the router configuration information to the SDN controller through the VIM northbound interface, it also creates a virtual firewall and firewall traffic policy by calling the VIM northbound interface and the security controller northbound interface, and creates a network between the firewall and the router to complete the network orchestration. The process of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

8. The method according to claim 7, characterized in that, The automatic creation of firewall traffic policies based on the firewall configuration information includes: Determine the firewall policies and rules required for the virtual firewall deployment in the firewall configuration information; Configure the traffic policy of the virtual firewall on the hardware firewall based on the firewall policies and rules required for the deployment of the virtual firewall.

9. The method according to claim 8, characterized in that, The configuration of traffic policies for the virtual firewall on the hardware firewall includes: Create a virtual firewall vSys through the northbound logical virtual device creation interface of the security controller; Create a logical sub-interface of the vSys through the northbound device creation interface of the security controller, and associate it with the specified security domain; Network interconnection between vSys and the VRF interconnected with the egress VRF and APP is achieved through the northbound interface of the security controller.

10. A network orchestration device based on Software-Defined Networking (SDN), characterized in that, include: A first communication unit and a first processing unit; wherein... The first communication unit is used to send firewall configuration information to the security controller, the firewall configuration information being used by the security controller to automatically create firewall traffic policies; and to send router configuration information to the SDN controller via the Virtual Infrastructure Manager (VIM) northbound interface, the router configuration information being used by the SDN controller to create an interface network between the firewall and the router; the interface network between the firewall and the router includes: a bidirectional network between the egress virtual route forwarding (VRF), the application interconnection VRF, and the virtual firewall vSys; the egress virtual route forwarding (VRF) is used to interface with external networks; After the first communication unit sends the router configuration information to the SDN controller through the VIM northbound interface, it is also used to create a virtual firewall and firewall traffic policy by calling the VIM northbound interface and the security controller northbound interface, and to create a network between the firewall and the router to complete network orchestration. The first communication unit creates a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creates a network interface between the firewall and the router, including: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

11. A network orchestration device based on Software-Defined Networking (SDN), characterized in that, include: The second communication unit and the second processing unit; wherein... The second communication unit is used to receive router configuration information sent by MEO through the Virtual Infrastructure Manager (VIM) northbound interface; The second processing unit is used to create a network between the firewall and the router based on the router configuration information; the network between the firewall and the router includes: a bidirectional network between the egress virtual route forwarding (VRF), the application APP interconnection VRF, and the virtual firewall vSys; the egress virtual route forwarding (VRF) is used to connect to external networks; The MEO sends router configuration information to the SDN controller via the VIM northbound interface. It is also used to create virtual firewalls and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and to create a network between the firewall and the router to complete network orchestration. The process of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

12. A network orchestration device based on Software-Defined Networking (SDN), characterized in that, include: The third communication unit and the third processing unit; wherein... The third communication unit is used to receive firewall configuration information sent by MEO; The third processing unit is used to automatically create firewall traffic policies based on the firewall configuration information; The SDN-based network orchestration device is also used to complete network interconnection between the firewall and the router; the network between the firewall and the router includes: a bidirectional network between the egress virtual route forwarding (VRF), the application APP interconnection VRF and the virtual firewall vSys; the egress virtual route forwarding (VRF) is used to connect to the external network; The MEO sends router configuration information to the SDN controller via the VIM northbound interface. It is also used to create virtual firewalls and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and to create a network between the firewall and the router to complete network orchestration. The process of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

13. A MEO, characterized in that, include: A first communication interface and a first processor; wherein... The first communication interface is used to send firewall configuration information to the security controller, which is used by the security controller to automatically create firewall traffic policies. Router configuration information is sent to the SDN controller via the Virtual Infrastructure Manager (VIM) northbound interface, which is used by the SDN controller to create an interface network between the firewall and the router. This interface network includes a bidirectional network between the egress virtual route forwarding (VRF), the application interconnection (APP) VRF, and the virtual firewall (vSys). The egress virtual route forwarding (VRF) is used to interface with external networks. After the first communication interface sends the router configuration information to the SDN controller through the VIM northbound interface, it is also used to create a virtual firewall and firewall traffic policy by calling the VIM northbound interface and the security controller northbound interface, and to create a docking network between the firewall and the router to complete network orchestration. The first communication interface creates a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creates a network interface between the firewall and the router, including: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

14. An SDN controller, characterized in that, include: A second communication interface and a second processor; wherein... The second communication interface is used to receive router configuration information sent by MEO through the Virtual Infrastructure Manager (VIM) northbound interface; The second processor is used to create a network between the firewall and the router based on the router configuration information; the network between the firewall and the router includes: a bidirectional network between the egress virtual route forwarding (VRF), the application APP interconnection VRF, and the virtual firewall vSys; the egress virtual route forwarding (VRF) is used to connect to external networks; The MEO sends router configuration information to the SDN controller via the VIM northbound interface. It is also used to create virtual firewalls and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and to create a network between the firewall and the router to complete network orchestration. The process of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

15. A safety controller, characterized in that, include: A third communication interface and a third processor; wherein... The third communication interface is used to receive firewall configuration information sent by MEO; The third processor is used to automatically create firewall traffic policies based on the firewall configuration information; The SDN-based network orchestration device is also used to complete network interconnection between the firewall and the router; the network between the firewall and the router includes: a bidirectional network between the egress virtual route forwarding (VRF), the application APP interconnection VRF and the virtual firewall vSys; the egress virtual route forwarding (VRF) is used to connect to the external network; The MEO sends router configuration information to the SDN controller via the VIM northbound interface. It is also used to create virtual firewalls and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and to create a network between the firewall and the router to complete network orchestration. The process of creating a virtual firewall and firewall traffic policies by calling the VIM northbound interface and the security controller northbound interface, and creating a network interface between the firewall and the router, includes: The VIM northbound native interface is invoked to create the aforementioned exit virtual route for forwarding the VRF; Call the VIM Northbound Interconnect Link Creation Interface to create the logical sub-interface of the VRF; Call the northbound logical virtual device creation interface of the security controller to create vSys; Call the northbound device creation interface of the security controller to create a logical sub-interface of the vSys and associate it with the specified security domain; The VIM northbound interface is invoked to complete the network interconnection between the exit virtual routing forwarding VRF, the VRF interconnected by the APP, and the vSys; The northbound interface of the security controller is invoked to complete network interconnection between the vSys and the VRF interconnected with the egress virtual route forwarding VRF and the APP.

16. A MEO, characterized in that, include: A first processor and a first memory for storing computer programs capable of running on the processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 4.

17. An SDN controller, characterized in that, include: A second processor and a second memory for storing computer programs that can run on the processor. Wherein, when the second processor is used to run the computer program, it performs the steps of the method according to any one of claims 5 to 6.

18. A safety controller, characterized in that, include: A third processor and a third memory for storing computer programs that can run on the processor. When the third processor runs the computer program, it performs the steps of the method according to any one of claims 7 to 9.

19. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4, or the steps of the method according to any one of claims 5 to 6, or the steps of the method according to any one of claims 7 to 9.

Images