Security net element arrangement method, device and equipment and readable storage medium

Abstract

The invention discloses a security element arrangement method, device and equipment and a readable storage medium, which are applied to the technical field of computers, and comprise the following steps: receiving a security element arrangement request; determining a target security manufacturer corresponding to the security element arrangement request; converting the security element arrangement request into a target manufacturer recognizable instruction according to the target security manufacturer; sending the target manufacturer recognizable instruction to a corresponding security management component, so that the security management component arranges a security network element based on the target manufacturer recognizable instruction; each security management component is a component which is integrated with the security element of each security manufacturer and is deployed on the cloud management platform. According to the method and the device, the security network elements are integrated in the security management component, and the security network elements are arranged based on the security management component, so that decoupling of the security network elements and the cloud management platform is realized, the security network elements can be arranged directly based on the security management component when being arranged, the operation and maintenance work is simplified, and the efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and readable storage medium for orchestrating secure network elements. Background Art

[0002] With the rapid development of cloud computing and big data technologies, enterprises are gradually migrating to cloud environments, and the deployment of cloud services has become the norm. However, this is accompanied by increasingly severe information security challenges. Security services such as cloud WAF, load balancing, bastion hosts, vulnerability scanning, and log auditing must be deployed efficiently and compliantly to ensure the data security of cloud tenants. The traditional method relies on manual creation of virtual machines in the cloud environment and installation and configuration of security network elements one by one, which is inefficient and prone to errors.

[0003] It can be seen that how to improve the efficiency of security network element orchestration is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a method, device, equipment and readable storage medium for orchestrating a secure network element, which solves the technical problem of low efficiency of orchestrating a secure network element in the prior art.

[0005] In order to solve the above technical problems, the present invention provides a secure network element arrangement method, comprising:

[0006] receiving a security network element orchestration request;

[0007] Determining a target security vendor corresponding to the security network element orchestration request;

[0008] Converting the security network element orchestration request into instructions recognizable by the target vendor according to the target security vendor;

[0009] The target vendor-recognizable instructions are sent to the corresponding security management component so that the security management component orchestrates the security network elements based on the target vendor-recognizable instructions; wherein each security management component is a component that has integrated the security network elements of each security vendor and is deployed on a cloud management platform.

[0010] On the one hand, the security network element orchestration request includes at least one of security management component registration to the cloud management platform, security network element lifecycle management, security network element single sign-on function, security network element authorization injection and security network element authorization unified management.

[0011] On the one hand, determining a target security vendor corresponding to the security network element orchestration request includes:

[0012] According to the vendor in the secure network element orchestration request, determine the target secure vendor corresponding to the secure network element orchestration request; wherein the secure network element orchestration request is a comprehensive instruction request including a secure network element orchestration instruction and a vendor, and the secure network element orchestration instruction is an instruction for determining an orchestration operation on a complete network element.

[0013] On the one hand, after sending the target vendor identifiable instruction to the corresponding security management component, it also includes:

[0014] receiving a processing result of the security management component executing the target vendor-recognizable instruction;

[0015] Convert the processing result into a format to obtain a processing result in a set format;

[0016] Determining whether the security network element arrangement is successful based on the set format processing result;

[0017] When unsuccessful, it is determined to re-perform the programming process based on the target manufacturer's recognizable instructions.

[0018] On the one hand, sending the target vendor-recognizable instruction to the corresponding security management component includes:

[0019] Determine the latest version image of the security network element;

[0020] The latest version image of the security network element is sent to the corresponding security management component to replace the historical version security network element image with the latest version image of the security network element.

[0021] On the one hand, the security network element arrangement method further includes:

[0022] Real-time monitoring of security network element virtual machine resources;

[0023] The monitoring information of the virtual machine resources of the security network element is obtained by using the unified operation and maintenance method of the security network element; wherein the monitoring information of the virtual machine resources of the security network element includes at least one of the utilization rate of the central processing unit, the memory usage, the number of disk read and write requests, the throughput of the network interface, the disk delay time and the number of attacks;

[0024] Determine threshold information corresponding to monitoring information of each of the security network element virtual machine resources;

[0025] Compare the monitoring information of the security network element virtual machine resources with the respective corresponding threshold information to determine the comparison result;

[0026] When it is determined according to the comparison result that the security network element virtual machine is abnormal, it is determined to send the alarm information to the cloud management platform so that the cloud management platform can uniformly visualize all the alarm information;

[0027] When it is determined according to the comparison result that the security network element virtual machine is normal, the continuous normal time of the security network element virtual machine is determined, and the security network element virtual machine resource monitoring time period is adjusted according to the continuous normal time.

[0028] On the one hand, after determining the target security vendor corresponding to the security network element orchestration request, the method further includes:

[0029] The cloud resource instructions are sent to the cloud resource controller so that the cloud resource controller controls the computing resources, network resources and storage resources, creates virtual machine resources that carry security network elements, makes configuration changes to the virtual machines of the security network elements, or reclaims the virtual machine resources of the security network elements.

[0030] The embodiment of the present invention further provides a secure network element arrangement device, including:

[0031] A secure network element arrangement request receiving module, used for receiving a secure network element arrangement request;

[0032] A target security vendor determination module, used to determine the target security vendor corresponding to the security network element orchestration request;

[0033] A target vendor recognizable instruction determination module, configured to convert the security network element orchestration request into a target vendor recognizable instruction according to the target security vendor;

[0034] A target vendor-recognizable instruction sending module is used to send the target vendor-recognizable instructions to the corresponding security management component so that the security management component can orchestrate the security network elements based on the target vendor-recognizable instructions; wherein each security management component is a component that has integrated the security network elements of each security vendor and is deployed on the cloud management platform.

[0035] The embodiment of the present invention further provides a secure network element arrangement device, including:

[0036] Memory for storing computer programs;

[0037] A processor is used to execute the computer program to implement the steps of the above-mentioned secure network element orchestration method.

[0038] An embodiment of the present invention further provides a readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned secure network element orchestration method are implemented.

[0039] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned security network element orchestration method when executed by a processor.

[0040] The purpose of the embodiments of the present invention is to provide a method, device, equipment and readable storage medium for orchestrating a secure network element, which can solve the technical problem of low efficiency in orchestrating a secure network element.

[0041] To solve the above technical problems, an embodiment of the present invention provides a security network element orchestration method, which may include: receiving a security network element orchestration request; determining a target security vendor corresponding to the security network element orchestration request; converting the security network element orchestration request into instructions recognizable to the target vendor according to the target security vendor; sending the instructions recognizable to the target vendor to the corresponding security management component, so that the security management component orchestrates the security network elements based on the instructions recognizable to the target vendor; wherein each security management component is a component that has integrated the security network elements of each security vendor and is deployed on a cloud management platform.

[0042] It can be seen from the above technical scheme that the beneficial effect of the present invention is that: by integrating the security network elements into the security management components, the security network elements do not directly interact with the cloud management platform, thereby realizing the decoupling of the cloud management platform from the security network element instances and the security vendor level. Therefore, the security network elements can be orchestrated based on the security management components, and flexible orchestration of security network element versions can be achieved. In addition, the orchestration of all security network elements can be realized, which simplifies the operation and maintenance work and improves efficiency.

[0043] In addition, the present invention also provides a secure network element orchestration device, equipment and readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flowchart of a secure network element orchestration method provided by an embodiment of the present invention;

[0046] Figure 2 A schematic diagram of the structural framework of a security orchestration method provided by an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of allocating instructions to corresponding manufacturers provided by an embodiment of the present invention;

[0048] Figure 4 A schematic diagram of the structure of a secure network element arrangement device provided by an embodiment of the present invention;

[0049] Figure 5 A schematic diagram of the structure of a secure network element arrangement provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] The terms "including" and "having" in the specification of the present invention and the above-mentioned drawings, as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed.

[0052] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0053] Next, a flowchart of a secure network element orchestration method provided by an embodiment of the present invention is introduced in detail. Figure 1 A flowchart of a secure network element orchestration method provided by an embodiment of the present invention, the secure network element orchestration method may include:

[0054] S101: Receive a security network element orchestration request.

[0055] The executor of this embodiment is an electronic device. In this embodiment, the electronic device can be a computer, a mobile phone, a cloud platform, etc. This embodiment does not limit the specific security network element orchestration request. The security network element orchestration request in this embodiment can be to add a security network element; or the security network element orchestration request in this embodiment can also be to delete a security network element; or the security network element orchestration request in this embodiment can also be a single sign-on function of a security network element. This embodiment does not limit the specific format of the security network element orchestration request. For example, the security network element orchestration request in this embodiment can be a method including a security vendor and a specific security network element orchestration instruction; or in this embodiment, it can be a security network element orchestration request, and the corresponding security network element security vendor is identified on the security network element orchestration request. It can be understood that this embodiment can separately assemble the function of receiving the security network element orchestration request into a component, for example, as a security network element capability standardization engine submodule, responsible for receiving various security network element orchestration requests.

[0056] It should be further explained that, in order to improve the efficiency of security network element orchestration, the above-mentioned security network element orchestration request may include at least one of the registration of the security management component to the cloud management platform, the life cycle management of the security network element, the single sign-on function of the security network element, the injection of security network element authorization, and the unified management of security network element authorization. The registration of the security management component to the cloud management platform in this embodiment is a key step to ensure the effective implementation of the enterprise security policy. Establishing a comprehensive cloud management platform to achieve centralized management, policy execution, situational awareness and rapid response of cloud security services is essential for maintaining the security of the enterprise's cloud environment. The life cycle management of the security network element in this embodiment refers to the security management and control of the entire process from creation to destruction of the security network element to ensure that it can maintain security and compliance at all stages. The single sign-on function of the security network element in this embodiment is an important technology in network security management. It allows users to access all mutually trusted application systems after one authentication in multiple application systems without repeatedly entering login credentials. The single sign-on function of the security network element not only improves the user experience, but also reduces the risk of password leakage and enhances the security of the system. The injection of security network element authorization in this embodiment refers to injecting code or commands into the application to obtain permissions or data access. The unified management of security network element authorization in this embodiment refers to the centralized management of the authorization operations of various security network elements (such as firewalls, intrusion detection systems, security event management systems, etc.) in the enterprise through a unified security management platform, ensuring that only authorized users can access and operate system resources. The embodiment of the present invention provides multiple security network element orchestration requests, so that multiple security network element orchestration requests can be completed using the method provided by the present invention, thereby improving the diversity of security network element orchestration.

[0057] S102: Determine a target security vendor corresponding to the security network element orchestration request.

[0058] This embodiment does not limit the specific method of determining the target security vendor corresponding to the security network element orchestration request. For example, this embodiment can determine the target security vendor based on the vendor part in the security network element orchestration request; or this embodiment can also determine the target security vendor based on the vendor identifier in the security network element orchestration request. The reason why this embodiment determines the target security vendor is to convert the specific operation instructions for the security network element in the security network element orchestration request into instructions that can be recognized by the vendor.

[0059] It should be further explained that, in order to improve the efficiency of determining the manufacturer, the above-mentioned determination of the target security manufacturer corresponding to the security network element orchestration request may include: determining the target security manufacturer corresponding to the security network element orchestration request according to the manufacturer in the security network element orchestration request; wherein the security network element orchestration request is a comprehensive instruction request including the security network element orchestration instruction and the manufacturer, and the security network element orchestration instruction is an instruction for determining the orchestration operation of the complete network element. This embodiment can directly determine the target security manufacturer according to the manufacturer in the security network element orchestration request, thereby improving the accuracy of determining the target security manufacturer.

[0060] It should be further explained that after determining the target security vendor corresponding to the security network element orchestration request, it can also include: sending cloud resource instructions to the cloud resource controller so that the cloud resource controller controls the computing resources, network resources and storage resources, creates virtual machine resources that carry security network elements, and performs configuration changes on the virtual machines of security network elements or reclaims the virtual machine resources of security network elements. At this time, after determining the vendor, the security network element corresponding to the vendor can be determined, so that the virtual machine resources can be dynamically created, configured and optimized through the cloud resource controller, thereby effectively supporting the operation of the security network element. This centralized and automated resource management method not only improves the efficiency of resource utilization, but also enhances the security and reliability of the system.

[0061] S103: Convert the security network element orchestration request into instructions recognizable to the target vendor according to the target security vendor.

[0062] This embodiment can make the function of converting the security network element orchestration request into instructions recognizable to the target vendor according to the target security vendor as a separate component, and utilize this component to realize the conversion of the security network element orchestration request into instructions recognizable to the target vendor according to the target security vendor. For example, the name of this component can be the security service management capability driver plug-in sub-module, so that it can interact with different security vendors.

[0063] S104, sending the target vendor-recognizable instructions to the corresponding security management component, so that the security management component orchestrates the security network elements based on the target vendor-recognizable instructions; wherein each security management component is a component that has integrated the security network elements of each security vendor and is deployed on the cloud management platform.

[0064] The security management component in this embodiment is responsible for the actual management of its security network elements, and the cloud management platform only interacts with the security management component of each manufacturer, reducing the functional coupling between the cloud management platform and the security network elements. This embodiment does not limit the specific method of deploying security network elements on the cloud management platform. For example, this embodiment can deploy security network elements on the cloud management platform in a containerized manner; or this embodiment can also deploy security network elements on the cloud management platform in a virtual machine manner.

[0065] It should be further explained that, in order to implement the upgrade of the security network element, the sending of the target vendor-recognizable instruction to the corresponding security management component may include: determining the latest version image of the security network element;

[0066] The latest version of the security network element image is sent to the corresponding security management component to replace the historical version of the security network element image with the latest version of the security network element image. This embodiment sends the latest version of the security network element image to the corresponding security management component so that the security management component can upgrade the security network element according to the latest version of the security network element image.

[0067] It should be further explained that, in order to improve the user experience, after sending the target manufacturer's identifiable instructions to the corresponding security management component, the following may also be included:

[0068] S1: receiving the processing result of the security management component executing the target manufacturer's identifiable instruction;

[0069] S2: Convert the processing result into a format to obtain a processing result in a set format;

[0070] S3: Determine whether the security network element arrangement is successful based on the set format processing result;

[0071] S4: When unsuccessful, determine to re-arrange the process based on the target manufacturer's recognizable instructions.

[0072] This embodiment does not limit the specific processing results. For example, the processing result in this embodiment may be successful orchestration; or the processing result may also be orchestration failure; or the processing result may also be orchestration after clearing the memory. This embodiment receives the processing result of the security management component executing the target manufacturer's recognizable instruction, and then determines whether the security network element orchestration instruction is successfully executed based on the processing result. If not, it will be re-arranged in time, thereby preventing the failure of security network element orchestration and improving the user experience.

[0073] It should be further explained that the above-mentioned security network element orchestration method may also include: real-time monitoring of security network element virtual machine resources; obtaining monitoring information of security network element virtual machine resources using a unified operation and maintenance method for security network elements; wherein the monitoring information of security network element virtual machine resources includes at least one of central processing unit utilization, memory usage, number of disk read and write requests, network interface throughput, disk delay time and number of attacks; determining threshold information corresponding to the monitoring information of each security network element virtual machine resource; comparing the monitoring information of the security network element virtual machine resources with the respective corresponding threshold information to determine a comparison result; when it is determined according to the comparison result that the security network element virtual machine is abnormal, determining to send an alarm information to the cloud management platform so that the cloud management platform can uniformly visualize all alarm information; when it is determined according to the comparison result that the security network element virtual machine is normal, determining the continuous normal time of the security network element virtual machine, and adjusting the monitoring time period of the security network element virtual machine resources according to the continuous normal time.

[0074] This embodiment first needs to obtain key monitoring information from each security network element virtual machine resource. This monitoring information includes but is not limited to the central processing unit (CPU) usage, memory usage, number of disk read and write requests, network interface throughput, disk latency, and number of attacks. These data are key indicators for evaluating system performance and security. For the monitoring information of each security network element virtual machine resource, corresponding threshold information needs to be set. These thresholds are derived based on system performance requirements, security standards, and historical data analysis, and are used to determine whether the system is in a normal state. For example, the normal threshold of CPU usage may be set to 70%, and exceeding this value may mean that the system load is too high. The acquired monitoring information of the security network element virtual machine resources is compared with the corresponding threshold information to determine the current operating status of the system. The comparison result will directly reflect whether there are potential problems or anomalies in the system. According to the comparison result, when the behavior of the security network element virtual machine is found to be abnormal, an alarm message needs to be generated. These alarm messages contain key information such as the specific description of the anomaly, the time of occurrence, and the possible scope of impact. The generated alarm message is sent to the cloud management platform. The cloud management platform is responsible for unified management and visual display of all alarm information, so that administrators can quickly understand the problems in the system and take corresponding measures. On the cloud management platform, all alarm information will be displayed in a visual form, such as charts, dashboards, etc., which is convenient for administrators to monitor the system status in real time and find and solve problems in time. This embodiment will monitor the virtual resources of the security network element to prevent the abnormality of the virtual machine resources of the security network element, which will cause the security network element to be unusable. In addition, the virtual machine resources of the security network element will be monitored in real time at the beginning. When it is determined that the continuous normal time exceeds a certain period of time, the monitoring time period of the virtual machine resources of the security network element will be adjusted. The adjustment of the monitoring period is based on the evaluation of the continuous normal time, which can allocate monitoring resources more flexibly, thereby optimizing the performance of the monitoring system while ensuring safety. For example, if a security network element virtual machine has no abnormal situation for one month, it can be considered to appropriately extend the interval time of the monitoring check (increased to once per minute) to reduce the pressure on the system. This adjustment can not only improve the efficiency of monitoring work, but also avoid unnecessary waste of resources. This embodiment realizes the unified operation and maintenance management of the virtual machine resources of the security network element, and improves efficiency and accuracy. Through real-time monitoring and rapid response, system failures can be effectively prevented and reduced to ensure stable system operation. At the same time, unified visual display enables administrators to understand the system status more intuitively, providing strong support for decision-making.

[0075] It should be further explained that when there are multiple security network elements that need to be orchestrated, the above-mentioned sending of the target manufacturer identifiable instructions to the corresponding security management component may include: determining the orchestration order of the security network elements according to the real-time network status, security requirements and performance data of the security network elements of each manufacturer, sending the target manufacturer identifiable instructions and the orchestration order of the security network elements to the security management component, so that the security management component is orchestrated according to the orchestration order of the security network elements, ensuring that the use efficiency of resources is optimized while meeting the security requirements. This embodiment does not limit the specific real-time network status. For example, in this embodiment, the real-time network status can be the type of network attack, at which time the orchestration order of the security network elements that can defend against the attack can be used as the first level, or the real-time network status in this embodiment can also be network performance, at which time the security network elements that can be quickly installed can be selected as the first level. The security requirements of this embodiment are user-defined requirements, and this embodiment does not limit specific security requirements. For example, the security requirements of this embodiment can be specific defenses that need to be implemented. The performance data of the security network elements of each manufacturer in this embodiment are to show the advantages and characteristics of each manufacturer in their respective security fields. For example, when a DDoS (distributed denial of service) attack is detected, the algorithm may prioritize the arrangement of network element devices with DDoS defense capabilities. This embodiment allows secure network elements to be arranged in order to prevent resource preemption.

[0076] It should be further explained that this embodiment can also collect real-time data from security network elements, including performance indicators, fault information, etc., predict potential security issues through machine learning analysis, and dynamically adjust the orchestration strategy to prevent or mitigate security incidents.

[0077] A method for orchestrating a security network element provided by an embodiment of the present invention may include: S101, receiving a security network element orchestration request; S102, determining a target security vendor corresponding to the security network element orchestration request; S103, converting the security network element orchestration request into a target vendor recognizable instruction according to the target security vendor; S104, sending the target vendor recognizable instruction to the corresponding security management component, so that the security management component orchestrates the security network element based on the target vendor recognizable instruction; wherein each security management component is a component that has integrated the security network element of each security vendor and is deployed on a cloud management platform. In an embodiment of the present invention, by integrating the security network element into the security management component, the security network element does not directly interact with the cloud management platform, thereby realizing the decoupling of the cloud management platform from the security network element instance and the security vendor level, so that the security network element can be orchestrated based on the security management component, realizing flexible upgrade and configuration management of the security network element version, and the orchestration of all security network elements can be realized, simplifying the operation and maintenance work, and improving the efficiency of the security network element orchestration.

[0078] In order to make the present invention easier to understand, please refer to Figure 2 , Figure 2 A schematic diagram of a structural framework of a security orchestration method provided by an embodiment of the present invention may specifically include:

[0079] like Figure 2 As shown, the embodiment of the present invention integrates security management components of different manufacturers and designs a security capability standardization engine sub-module and a security service management capability driver plug-in sub-module of the cloud management platform. The cloud management platform implements the issuance and management functions of security network elements through security management components of different manufacturers, and does not directly interact with the security network element instances, thereby realizing the decoupling of the cloud management platform from the security network element instances and the security vendor management level. Through this standardized and low-coupling design, the cloud management platform can realize flexible upgrade and configuration management of the security network element version. At the same time, the unified operation and maintenance management sub-module of the security network element collects the network element virtual machine resource monitoring information and reports the network element alarm information through the standard SNMP protocol, thereby realizing the unified operation and maintenance of the network elements.

[0080] 1) Security management component: Each security vendor provides a security management component, which is deployed in a containerized manner on the container base of the cloud management platform. The security management component of each security vendor is responsible for the actual management of its security network elements. The cloud management platform only interacts with the security management component of each vendor, reducing the functional coupling between the cloud management platform and security network elements.

[0081] The security network element instance of manufacturer A in this embodiment includes WAF (firewall), log audit, bastion host, and other network elements.

[0082] 2) Containerized deployment of security management components: Security management components from different vendors are deployed in containers and run on the management nodes of the cloud management platform based on pods (containers), simplifying the network topology with the cloud platform.

[0083] 3) Security network element capability standardization engine submodule: The cloud management platform security capability standardization engine layer defines the security atomic capabilities that the security cloud management platform network elements need to have (i.e., the functional requests used by each security network element), including the registration of security management components to the cloud management platform, the life cycle management of security network elements (addition, deletion, modification, and query), the single sign-on function of security network elements, the authorization injection of security network elements, and the unified management of security authorizations. The functions can be expanded as needed;

[0084] 4) Security service management capability driver plug-in submodule: Different drivers are defined through the cloud management platform driver layer to interact with security management components of different security vendors. The driver layer serves as a conversion layer between the security capability standardization engine submodule and the security management components provided by the vendor. It is responsible for converting the operation instructions of the security capability standardization engine submodule (such as creating a security network element) into instructions or APIs (interfaces) recognizable by security management components of different vendors, and converting the differentiated messages fed back by the interfaces of security management components of different vendors into messages in the format uniformly required by the security capability standardization engine submodule;

[0085] 5) Security network element image management submodule: There are different security network element virtual machine images from different manufacturers. When a network element image needs to be upgraded, the new image can be registered to the security network element image management submodule to realize on-demand upgrade of the network element version; when an upgrade is required, the security network element capability standardization engine submodule creates a security network element, pulls the image from the security network element image management submodule, and sends the instruction to the security service management capability driver plug-in module, and sends it to the security management component.

[0086] 6) Standardized interfaces and vendor neutrality: Security network elements use the main version of the security vendor (the main version can be understood as the basic version, which is used by each version of security network elements). No customized interface development is performed. Instead, the security management components provided by the vendor are connected to the cloud management platform. The cloud management platform and security network elements are decoupled, and security network elements can be upgraded instantly with the vendor version.

[0087] 7) Security network element unified operation and maintenance management submodule: For the security network element virtual machine instance, the CPU (central processing unit), memory, hard disk, network card and other status are monitored in real time; at the same time, the alarms generated by the security network element's own applications are collected and sent to the cloud platform for monitoring alarms, so that users can timely understand the operating status of the network element (after the security network element generates an alarm, it is pushed to the cloud management platform, and the cloud management platform makes a unified alarm display).

[0088] In order to make the present invention easier to understand, a security orchestration method provided by an embodiment of the present invention may specifically include:

[0089] Step 1: Operate through the security capability interaction layer user, or interact with a third-party system outside the cloud management platform to determine the security network element orchestration request.

[0090] Step 2: After receiving the security network element orchestration request, the security capability standardization engine submodule parses the security network element orchestration, obtains the corresponding manufacturer, and calls the corresponding driver.

[0091] The security capability standardization engine submodule in this embodiment serves as a standard capability definition layer, and defines standard security atomic capabilities for the upper-layer security capability interaction layer to call, shielding the differences between the security management components of different security vendors at the bottom layer. When the security capability standardization engine submodule interacts with the security service management capability driver plug-in submodule, it will pass the security atomic capability operation instruction to the driver layer through the comprehensive instruction method of <atomic operation instruction, manufacturer>. The driver layer identifies the target security vendor security management plug-in to be operated through the comprehensive instruction; standard security atomic capabilities include: security vendor security management component registration, security network element life cycle management (security network element addition, deletion, modification, query, etc.), security network element single sign-on, security network element authorization injection, security network Unified authorization management of elements: unified authorization tracking, unified authorization display, unified authorization deletion, etc.; at the same time, the security capability standardization engine submodule interacts with the security network element image management submodule, and pulls the virtual machine image of the corresponding security network element from the security network element image management submodule when executing the atomic operation of adding new security network elements, which is used to create virtual machine resources that carry security network elements; the security capability standardization engine submodule interacts with the cloud resource controller, and is responsible for sending cloud resource-related instructions to the cloud resource controller when performing atomic operations such as adding, deleting, modifying and checking security network elements. The cloud resource controller controls cloud basic resources such as computing, networking, and storage, creates virtual machine resources that carry security network elements, and makes configuration changes to the virtual machines of security network elements or recycles the virtual machine resources of security network elements.

[0092] Step 3: The security service management capability drives the plug-in submodule to convert the standardized security atomic operation instructions into instructions that can be recognized by the security management components of each manufacturer and issue them to perform relevant operations of the security network element. Figure 3 As shown, Figure 3 A schematic diagram of allocating instructions to corresponding manufacturers is provided for an embodiment of the present invention. The security atomic capability driver adapter of the security service management capability driver plug-in submodule receives a comprehensive instruction issued by the security capability standardization engine submodule, such as <Create security network element, A>. After parsing the comprehensive instruction, it recognizes that the atomic instruction is an instruction for manufacturer A to create a security network element asset. Then, the security atomic capability driver adapter forwards the instruction to the corresponding manufacturer driver plug-in. After receiving the atomic instruction, the corresponding manufacturer driver plug-in is responsible for converting the atomic instruction into an instruction recognizable by the security management component of the corresponding manufacturer and issuing it to the security management component of the corresponding manufacturer. The driver plug-in of the security service management capability driver plug-in submodule is designed to be pluggable and can be expanded according to actual needs. After adding the security management component of the underlying manufacturer, only the corresponding driver plug-in needs to be added to achieve decoupling from the upper standardization engine layer.

[0093] Step 4: The manufacturer's security management component returns the operation results of executing the security atomic capability to the security capability standardization engine sub-module through the manufacturer's driver plug-in. After being processed in a unified format, the security capability standardization engine sub-module is notified to complete the result feedback.

[0094] Step 5. After the security network element is successfully created, the security network element reports the alarm data of its own system to the security network element unified operation and maintenance management submodule through the standard SNMP protocol (Simple Network Management Protocol). At the same time, the security network element unified operation and maintenance management submodule collects the monitoring information of the virtual machine resources carrying the security network element (CPU, memory, storage and other indicators) to realize unified monitoring and alarm of the security network element.

[0095] Step six, store security network element images from different manufacturers through the security network element image management submodule. When creating a security network element, the security network element capability standardization engine submodule interacts with the security network element image management submodule to pull the image of the corresponding security network element of the corresponding manufacturer to create a virtual machine resource that carries the security network element. When the security network element version needs to be upgraded, directly upload the new version image to the security network element image management submodule and replace the corresponding old version image, so as to realize the rapid iterative upgrade of the security network element version.

[0096] The embodiment of the present invention defines unified standard security atomic capabilities such as security network element lifecycle management and authorization management through a security capability standardization engine submodule, and realizes the decoupling of the standardized security atomic capabilities of the cloud management platform standardization engine submodule from the security management capabilities of different underlying security vendors through standardized interfaces and driver plug-in submodules. The driver plug-in interacts with the security management component of the security vendor to convert differentiated instructions of different security vendors into standard instructions recognizable by the cloud management platform. At the same time, by defining pluggable driver plug-ins of different security vendors, different security vendors can be flexibly connected as needed. To connect to a new vendor, it only needs to develop the corresponding driver plug-in, which greatly reduces the integration workload. Overall, it simplifies the automated issuance and management process of security network element instances for cloud tenants on the cloud management platform, and realizes standardized adaptation of the cloud management platform and network elements.

[0097] The following is an introduction to a secure network element orchestration device provided in an embodiment of the present invention. The secure network element orchestration device described below and the secure network element orchestration method described above can be referenced to each other.

[0098] Figure 4 A structural diagram of a secure network element orchestration device provided by an embodiment of the present invention may specifically include:

[0099] A secure network element orchestration request receiving module 100, configured to receive a secure network element orchestration request;

[0100] A target security vendor determining module 200 is used to determine a target security vendor corresponding to the security network element orchestration request;

[0101] A target vendor recognizable instruction determination module 300, configured to convert the security network element orchestration request into a target vendor recognizable instruction according to the target security vendor;

[0102] The target vendor identifiable instruction sending module 400 is used to send the target vendor identifiable instruction to the corresponding security management component so that the security management component can orchestrate the security network elements based on the target vendor identifiable instruction; wherein each security management component is a component that has integrated the security network elements of each security vendor and is deployed on the cloud management platform.

[0103] Further, based on the above embodiment, the above security network element orchestration request includes at least one of security management component registration to the cloud management platform, security network element lifecycle management, security network element single sign-on function, security network element authorization injection and security network element authorization unified management.

[0104] Further, based on any of the above embodiments, the target security vendor determination module 200 may include:

[0105] A target security vendor determination unit is used to determine the target security vendor corresponding to the security network element orchestration request according to the vendor in the security network element orchestration request; wherein the security network element orchestration request is a comprehensive instruction request including a security network element orchestration instruction and a vendor, and the security network element orchestration instruction is an instruction for determining the orchestration operation of a complete network element.

[0106] Further, based on any of the above embodiments, the above security network element orchestration device may further include:

[0107] A processing result determination module, configured to receive a processing result of the security management component executing the target vendor identifiable instruction;

[0108] A format conversion module, used for converting the processing result into a format to obtain a processing result in a set format;

[0109] A judgment module, used to determine whether the security network element arrangement is successful based on the set format processing result;

[0110] The re-arrangement module is used to determine to re-arrange the process based on the target manufacturer's recognizable instructions when the process fails.

[0111] Further, based on any of the above embodiments, the target manufacturer identifiable instruction sending module 400 may include:

[0112] A security network element latest version image determination unit, used to determine the security network element latest version image;

[0113] The security network element update unit is used to send the latest version image of the security network element to the corresponding security management component so as to replace the historical version security network element image with the latest version image of the security network element.

[0114] Further, based on any of the above embodiments, the above security network element orchestration device may further include:

[0115] Resource monitoring module, used to monitor the virtual machine resources of security network elements in real time;

[0116] A monitoring information acquisition module, used to obtain monitoring information of security network element virtual machine resources using a unified operation and maintenance method for security network elements; wherein the monitoring information of the security network element virtual machine resources includes at least one of a central processing unit utilization rate, memory usage, number of disk read and write requests, network interface throughput, disk delay time, and number of attacks;

[0117] A threshold information determination module, used to determine the threshold information corresponding to the monitoring information of each of the security network element virtual machine resources;

[0118] A comparison result determination module, used to compare the monitoring information of the virtual machine resources of the security network element with the respective corresponding threshold information to determine the comparison result;

[0119] An alarm information sending module is used to determine that the alarm information is sent to the cloud management platform when it is determined that the security network element virtual machine is abnormal according to the comparison result, so that the cloud management platform can perform a unified visual display of all alarm information;

[0120] The time period adjustment module is used to determine the continuous normal time of the security network element virtual machine when it is determined that the security network element virtual machine is normal according to the comparison result, and adjust the security network element virtual machine resource monitoring time period according to the continuous normal time.

[0121] Further, based on any of the above embodiments, the above security network element orchestration device may further include:

[0122] The resource control module is used to send cloud resource instructions to the cloud resource controller so that the cloud resource controller can control computing resources, network resources and storage resources, create virtual machine resources that carry security network elements, make configuration changes to the virtual machines of security network elements, or recycle the virtual machine resources of security network elements.

[0123] It should be noted that the order of the modules and units in the above-mentioned security network element arrangement device can be changed before or after without affecting the logic.

[0124] Figure 4 The description of the features in the corresponding embodiments can be found in Figure 4 The relevant descriptions of the corresponding embodiments will not be repeated here one by one.

[0125] A security network element orchestration device provided by an embodiment of the present invention may include: a security network element orchestration request receiving module 100, used to receive a security network element orchestration request; a target security vendor determination module 200, used to determine the target security vendor corresponding to the security network element orchestration request; a target vendor recognizable instruction determination module 300, used to convert the security network element orchestration request into a target vendor recognizable instruction according to the target security vendor; a target vendor recognizable instruction sending module 400, used to send the target vendor recognizable instruction to the corresponding security management component, so that the security management component orchestrates the security network element based on the target vendor recognizable instruction; wherein each security management component is a component that has integrated the security network element of each security vendor and is deployed on a cloud management platform. The embodiment of the present invention integrates security network elements into the security management component, and the security network elements do not directly interact with the cloud management platform, thereby achieving decoupling of the cloud management platform from the security network element instances and the security vendor level. Therefore, the security network elements can be orchestrated based on the security management component, and flexible upgrades and configuration management of security network element versions can be achieved. In addition, the orchestration of all security network elements can be realized, which simplifies the operation and maintenance work and improves the efficiency of security network element orchestration.

[0126] A secure network element orchestration device provided by an embodiment of the present invention is introduced below. The secure network element orchestration device described below and the secure network element orchestration method described above can refer to each other.

[0127] Figure 5 A schematic diagram of a secure network element arrangement provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the security network element arrangement includes: a memory 60 for storing computer programs;

[0128] The processor 61 is used to implement the steps of the security network element orchestration method in the above embodiment when executing the computer program.

[0129] The secure network element orchestration device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0130] Among them, the processor 61 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 61 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 61 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 61 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 61 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0131] The memory 60 may include one or more computer-readable storage media, which may be non-transitory. The memory 60 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 60 is at least used to store the following computer program 601, wherein the computer program, after being loaded and executed by the processor 61, can implement the relevant steps of the secure network element orchestration method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 60 may also include an operating system 602 and data 603, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 602 may include Windows, Unix, Linux, etc. Data 603 may include, but is not limited to, secure network element orchestration data, etc.

[0132] In some embodiments, the security network element orchestration device may also include a display screen 62 , an input and output interface 63 , a communication interface 64 , a power supply 65 , and a communication bus 66 .

[0133] Those skilled in the art will understand that Figure 5 The structure shown in does not constitute a limitation on the secure network element orchestration device and may include more or fewer components than those shown in the figure.

[0134] It is understandable that if the security network element orchestration method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the contribution to the current technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk or optical disk and other media that can store program code.

[0135] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned security network element orchestration method are implemented.

[0136] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned security network element orchestration method when executed by a processor.

[0137] The above is a detailed introduction to a method, device, equipment and readable storage medium for arranging secure network elements provided by an embodiment of the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0138] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0139] The above is a detailed introduction to a secure network element orchestration method, device, equipment and readable storage medium provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A method for arranging secure network elements, characterized in that: include: receiving a security network element orchestration request; Determining a target security vendor corresponding to the security network element orchestration request; Converting the security network element orchestration request into instructions recognizable by the target vendor according to the target security vendor; The target vendor-recognizable instructions are sent to the corresponding security management component so that the security management component orchestrates the security network elements based on the target vendor-recognizable instructions; wherein each security management component is a component that has integrated the security network elements of each security vendor and is deployed on a cloud management platform.

2. The method for arranging secure network elements according to claim 1, characterized in that: The security network element orchestration request includes at least one of security management component registration to a cloud management platform, security network element lifecycle management, security network element single sign-on function, security network element authorization injection, and security network element authorization unified management.

3. The method for arranging secure network elements according to claim 1, characterized in that: Determining a target security vendor corresponding to the security network element orchestration request includes: According to the vendor in the secure network element orchestration request, determine the target secure vendor corresponding to the secure network element orchestration request; wherein the secure network element orchestration request is a comprehensive instruction request including a secure network element orchestration instruction and a vendor, and the secure network element orchestration instruction is an instruction for determining an orchestration operation on a complete network element.

4. The method for arranging secure network elements according to any one of claims 1 to 3, characterized in that: After sending the target vendor identifiable instruction to the corresponding security management component, the method further includes: receiving a processing result of the security management component executing the target vendor-recognizable instruction; Convert the processing result into a format to obtain a processing result in a set format; Determining whether the security network element arrangement is successful based on the set format processing result; When unsuccessful, it is determined to re-perform the programming process based on the target manufacturer's recognizable instructions.

5. The method for arranging secure network elements according to claim 1, characterized in that: Sending the target vendor-recognizable instruction to a corresponding security management component includes: Determine the latest version image of the security network element; The latest version image of the security network element is sent to the corresponding security management component to replace the historical version security network element image with the latest version image of the security network element.

6. The method for arranging secure network elements according to claim 1, characterized in that: The security network element arrangement method further includes: Real-time monitoring of security network element virtual machine resources; The monitoring information of the virtual machine resources of the security network element is obtained by using the unified operation and maintenance method of the security network element; wherein the monitoring information of the virtual machine resources of the security network element includes at least one of the utilization rate of the central processing unit, the memory usage, the number of disk read and write requests, the throughput of the network interface, the disk delay time and the number of attacks; Determine threshold information corresponding to monitoring information of each of the security network element virtual machine resources; Compare the monitoring information of the security network element virtual machine resources with the respective corresponding threshold information to determine the comparison result; When it is determined according to the comparison result that the security network element virtual machine is abnormal, it is determined to send the alarm information to the cloud management platform so that the cloud management platform can uniformly visualize all the alarm information; When it is determined according to the comparison result that the security network element virtual machine is normal, the continuous normal time of the security network element virtual machine is determined, and the security network element virtual machine resource monitoring time period is adjusted according to the continuous normal time.

7. The method for arranging secure network elements according to claim 1, characterized in that: After determining the target security vendor corresponding to the security network element orchestration request, the method further includes: The cloud resource instructions are sent to the cloud resource controller so that the cloud resource controller controls the computing resources, network resources and storage resources, creates virtual machine resources that carry security network elements, makes configuration changes to the virtual machines of the security network elements, or reclaims the virtual machine resources of the security network elements.

8. A secure network element arrangement device, characterized in that: include: A secure network element arrangement request receiving module, used for receiving a secure network element arrangement request; A target security vendor determination module, used to determine the target security vendor corresponding to the security network element orchestration request; A target vendor recognizable instruction determination module, configured to convert the security network element orchestration request into a target vendor recognizable instruction according to the target security vendor; A target vendor-recognizable instruction sending module is used to send the target vendor-recognizable instructions to the corresponding security management component so that the security management component can orchestrate the security network elements based on the target vendor-recognizable instructions; wherein each security management component is a component that has integrated the security network elements of each security vendor and is deployed on the cloud management platform.

9. A secure network element arrangement device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the secure network element orchestration method as claimed in any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the secure network element orchestration method according to any one of claims 1 to 7 are implemented.

Images