Network security workload arrangement method and device, medium, equipment and product

Abstract

The invention discloses a network security workload arrangement method and device, a medium, equipment and a product, and the method comprises the steps: obtaining the target configuration information of at least one network security product corresponding to a cloud service, and obtaining the server information of all security servers in a first security server set; wherein the target configuration information comprises server resource quantity configured for each network security product in the at least one network security product, the server information comprises available resource quantity of all security servers, and different security servers are connected with a security switch corresponding to the cloud service through a uniform interface; and performing load arrangement on the workload of the at least one network security product based on the target configuration information and the server information. Therefore, server resources of each security server can be fully utilized, and resource waste is avoided.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular, to a network security workload orchestration method, apparatus, medium, equipment, and product. Background Art

[0002] Network security products in cloud services can ensure the security of data during transmission and storage. Generally, they need to be directly detected and analyzed based on the user's business traffic, or detected and analyzed after mirroring / splitting the business traffic.

[0003] In order to meet the high-performance traffic processing requirements, in the related art, when deploying the workload of network security products, one or more security servers are usually deployed separately for each network security product. However, since the server resources required by each network security product are different, it is easy to cause a waste of resources. Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides a network security workload orchestration method, the method comprising: Obtain target configuration information of at least one network security product corresponding to the cloud service, and obtain server information of all security servers in the first security server set; wherein the target configuration information includes the server resource amount configured for each network security product in the at least one network security product, and the server information includes the available resource amount of all security servers, and different security servers are connected to the security switch corresponding to the cloud service through a unified interface; Based on the target configuration information and the server information, workload orchestration is performed on the workload of the at least one network security product.

[0006] In a second aspect, the present disclosure provides a network security workload orchestration device, the device comprising: An acquisition module, used to acquire target configuration information of at least one network security product corresponding to the cloud service, and to acquire server information of all security servers in the first security server set; wherein the target configuration information includes the server resource amount configured for each network security product in the at least one network security product, and the server information includes the available resource amount of all security servers, and different security servers are connected to the security switch corresponding to the cloud service through a unified interface; A load orchestration module is used to perform load orchestration on the workload of the at least one network security product based on the target configuration information and the server information.

[0007] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements the steps of the method described in the first aspect when the program is executed by a processing device.

[0008] In a fourth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method in the first aspect.

[0009] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, which implements the steps of the method described in the first aspect when executed by a processor.

[0010] Through the above technical solution, the target configuration information of at least one network security product corresponding to the cloud service and the server information of all security servers in the first security server set are first obtained, and then the workload of at least one network security product is load orchestrated based on the target configuration information and the server information. Since different security servers can be connected to the security switch corresponding to the cloud service through a unified interface, the workload of network security products with different network networking and configuration connection methods can be deployed to the same security server. In this way, when deploying the workload of the network security product, the server resources of each security server can be fully utilized, thereby avoiding waste of resources.

[0011] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 is a schematic diagram of a cloud service according to an exemplary embodiment of the present disclosure; Figure 2 It is a flowchart of a network security workload orchestration method according to an exemplary embodiment of the present disclosure; Figure 3 is a schematic diagram of a process of load scheduling and traffic scheduling according to an exemplary embodiment of the present disclosure; Figure 4is a structural block diagram of a network security workload orchestration device according to an exemplary embodiment of the present disclosure; Figure 5 It is a schematic structural diagram of an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0013] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0014] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0015] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0016] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0017] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0018] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0019] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0020] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0021] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0022] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0023] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0024] like Figure 1 As shown, first Figure 1 The terms that appear in the following sections are explained. A network-connected switch is a switch role used in the hybrid cloud network architecture to interconnect with the user's own switch. A security switch is a switch role that is specifically used to directly connect to network security products. A core switch is a switch role responsible for handling the main data transmission and routing in the network. A security server is the abbreviation of a physical machine server used to deploy network security products. An access switch is a switch role that connects to a physical machine. DDoS (Distributed Denial of Service) products refer to network security products for distributed denial of service attacks. NTA (Network Traffic Analysis) products refer to products that include network intrusion detection technologies such as feature detection and correlation analysis based on DPI (Deep Packet Inspection, a network packet filtering technology). FW (Firewall) refers to cloud firewall security products. Traffic diversion refers to the technology of redirecting network traffic from the original path to a specific security device or service. Mirroring and splitting are two commonly used technologies for copying network packets or traffic.

[0025] Continue to refer to Figure 1, hybrid cloud is deployed in the user's IDC (Internet Data Center) or other independent computer rooms. The user decides whether to connect with the public cloud on demand. If not, it can be used as a private cloud. In a public cloud environment, network security products are usually shared clusters for all tenants on the cloud. In order to meet the requirements of large bandwidth and high performance, they are usually deployed in clusters and configured in accordance with the network networking and configuration connection methods of network security products.

[0026] In the hybrid cloud scenario, the hybrid cloud needs to deploy network security products according to the needs of each user. It should be noted that different network security products using splitting, mirroring, diversion and other methods have different corresponding network networking and configuration connection methods. In the related technology, one deployment method is to deploy one or more security servers for each network security product separately. A security server is a physical machine, but since the server resources required for each network security product are different, it is easy to cause waste of resources. Another deployment method is to deploy based on virtual machines, that is, by deploying virtual machines in the security server, the workloads of multiple network security products can be deployed separately to different virtual machines on the same security server, but it is also limited by the network networking and configuration connection methods of network security products. The same security server can only deploy network security products with the same network networking and configuration connection methods, and the virtual machine itself needs to occupy a large amount of resources, and the virtual machine is difficult to operate and maintain during startup, debugging and fault migration.

[0027] In addition, when users expand their business capacity, they need to perform complex and time-consuming network and operation and maintenance configurations, such as network wiring and routing or mirroring configurations. Therefore, it is impossible to support dynamic and flexible rapid expansion and enable the workload of network security products.

[0028] In view of this, the present disclosure provides a network security workload orchestration method, apparatus, medium, equipment and product to solve the above technical problems.

[0029] The embodiments of the present disclosure are further explained below with reference to the accompanying drawings.

[0030] Figure 2 is a flowchart of a network security workload orchestration method according to an exemplary embodiment of the present disclosure, referring to Figure 2 , the method may include the following steps: S201: Obtain target configuration information of at least one network security product corresponding to the cloud service, and obtain server information of all security servers in the first security server set; wherein the target configuration information includes the server resource amount configured for each network security product in the at least one network security product, and the server information includes the available resource amount of all security servers, and different security servers are connected to the security switch corresponding to the cloud service through a unified interface.

[0031] It should be noted that the above cloud services include but are not limited to private cloud, public cloud, hybrid cloud and cloud services of other architectures. Server resources include CPU (Central Processing Unit), memory and other resources corresponding to network security products, which are not limited in this disclosure.

[0032] For example, unlike the related art, which requires each network security product to be connected to a security switch and configured with specific configuration information, all security servers in the disclosed embodiment are configured as multi-network card models, and the network cards of all security servers are interconnected with the security switch in a standardized and consistent manner, so there is no need to perform specific configuration according to the network security product cluster. In other words, all security servers are interconnected with the security switch in an indiscriminate manner, so any required workload can be flexibly run on each security server according to user needs, and it supports running the workloads of multiple network security products at the same time.

[0033] S202: Based on the target configuration information and the server information, perform load orchestration on the workload of at least one network security product.

[0034] In a possible manner, based on target configuration information and server information, the workload of at least one network security product is load orchestrated, including: based on the target configuration information and server information, determining a target security server for deploying the workload of at least one network security product from all security servers, and deploying the workload of at least one network security product to the target security server, wherein the available resources of the target security server are greater than or equal to the server resources configured for the at least one network security product.

[0035] By way of example, the target security server may be one or more than one, and the same security server may deploy multiple workloads of one network security product or multiple workloads of different network security products. For example, when the available resources of security server A are greater than or equal to the server resources configured for network security product X, all workloads of network security product X may be deployed to security server A. Or, when the available resources of security server A are less than the server resources configured for network security product X, the workload of network security product X may be divided into multiple workloads and deployed respectively to multiple security servers including security server A. Or, in order to avoid the entire workload of network security product X being unavailable due to an abnormality in security server A, when the available resources of security server A are greater than or equal to the server resources configured for network security product X, the workload of network security product X may be divided into multiple workloads and deployed respectively to multiple security servers including security server A. The specific workloads may be determined according to the needs, and the present disclosure does not limit this.

[0036] It should be understood that when performing load orchestration, the target configuration information may also include the number of workloads, etc., which may be specifically configured based on user needs, and when performing load orchestration, load orchestration may also be performed in combination with the set load orchestration strategy, which is not limited in this disclosure.

[0037] With the above method, since different security servers can be connected to the security switch corresponding to the cloud service through a unified interface, the workloads of network security products with different network configurations and connection modes can be deployed on the same security server. In this way, when deploying the workloads of network security products, the server resources of each security server can be fully utilized, thereby avoiding waste of resources.

[0038] For ease of understanding, assume that the workload of network security product X includes workload 1 deployed on security server A, workload 2 deployed on security server B, and workload 3 deployed on security server C. In the subsequent use process, users can scale up or down the network security product according to business needs, and they need to create or delete workloads.

[0039] In a possible manner, the method also includes: obtaining first configuration update information for a first network security product among at least one network security product, wherein the new server resource amount configured for the first network security product in the first configuration update information is less than the server resource amount configured for the first network security product in the target configuration information; determining a first workload to be deleted from the workloads of the first network security product based on the first configuration update information; determining a first security server on which the first workload is deployed, and deleting the first workload deployed in the first security server.

[0040] For example, when the user reduces the server resources allocated to network security product X according to changes in business needs, the configuration information for network security product X can be reconfigured to reduce the server resources configured for network security product X. Then, based on the newly configured configuration information, the workload to be deleted and the security server where the workload is located can be determined. Assuming workload 1 and security server A, workload 1 deployed in security server A is deleted. Thus, through simple configuration, fast and flexible product scaling can be achieved according to user needs.

[0041] In a possible manner, the method also includes: obtaining second configuration update information for a second network security product among at least one network security product, wherein the new server resource amount configured for the second network security product in the second configuration update information is greater than the server resource amount configured for the second network security product in the target configuration information; determining a second workload of the second network security product to be deployed based on the second configuration update information and the server information, and determining a second security server for deploying the second workload from the first security server set; and deploying the second workload to the second security server.

[0042] For example, when the user increases the server resources allocated to network security product X according to changes in business needs, the configuration information for network security product X can be reconfigured to increase the server resources configured for network security product X. Then, based on the newly configured configuration information and server information, the workload to be deployed and the security server used to deploy the workload can be determined, and then the newly added workload can be deployed in the determined security server, for example, workload 4 can be deployed in security server D. Thus, through simple configuration, fast and flexible product expansion can be achieved according to user needs.

[0043] Through the above method, there is no need to perform complex and time-consuming network and operation and maintenance configuration. By configuring the server resource amount of the network security product, the creation and deletion of workloads can be adaptively executed, achieving fast and flexible product expansion and reduction.

[0044] In a possible manner, determining a second security server for deploying a second workload from a first security server set includes: in a case where, in the second security server set for deploying a workload of a second network security product, there is a security server whose available resources are greater than or equal to the server resources required for the second workload, determining the second security server from the second security server set, the first security server set including the second security server set; in a case where there is no security server in the second security server set whose available resources are greater than or equal to the server resources required for the second workload, determining the second security server from other security servers in the first security server set excluding the second security server set.

[0045] For example, the workload of network security product X includes workload 1 deployed on security server A, workload 2 deployed on security server B, and workload 3 deployed on security server C. When the available resource amount of at least one security server among security server A, security server B, and security server C is greater than or equal to the server resource amount required by the second workload, the second workload can be deployed to at least one security server. It should be noted that the second workload can be deployed entirely to one security server in at least one security server, or the second workload can be divided into multiple workloads and deployed to multiple security servers in at least one security server respectively, and the present disclosure does not limit this.

[0046] For example, when the sum of available resources of multiple security servers among security server A, security server B and security server C is greater than or equal to the server resources required by the second workload, the second workload can be divided into multiple workloads and deployed to multiple security servers respectively.

[0047] For example, when none of the security servers A, B, and C has an available resource amount or the sum of the available resource amounts of multiple security servers is greater than or equal to the server resource amount required for the second workload, one or more security servers other than security server A, B, and C may be selected to deploy the second workload, and the available resource amount of the selected security server is greater than or equal to the server resource amount required for the second workload, and the selected security server may be an existing security server or a newly deployed security server, and the present disclosure does not impose any restrictions on this.

[0048] That is to say, if the server resource amount of the security server where the network security product X is originally deployed meets the conditions, the expanded workload can be deployed in the original security server. If the server resource amount of the security server where the network security product X is originally deployed does not meet the conditions, the expanded workload can be deployed in other security servers, or after a new security server is deployed, the expanded workload can be deployed in the new security server.

[0049] Of course, if the server resource amount of the security server originally deploying network security product X meets the conditions, the second workload can also be deployed to other security servers. In this way, the workload of network security product X can be deployed separately to avoid the situation where the workload of network security product X is completely unavailable when the original security server is abnormal. The specific details can be determined according to needs, and the present disclosure does not impose any restrictions on this.

[0050] It should be understood that when load orchestration is performed on a newly added workload, load orchestration may also be performed in combination with a set load orchestration strategy, and the present disclosure does not limit this.

[0051] In a possible manner, each security server is deployed with a corresponding proxy component, and the method further includes: in response to a registration request of the proxy component, establishing a communication connection with the proxy component. Obtaining server information of all security servers in the first security server set includes: receiving server information of the corresponding security server sent by each proxy component, and obtaining server information of all security servers.

[0052] For example, each security server is deployed with a corresponding agent component, which is connected to the network resource security manager to receive instructions issued by the network resource security manager and report server information of the corresponding security server. The network resource security manager is used to perform load orchestration and issue corresponding instructions.

[0053] In a possible manner, each security server is deployed with a corresponding agent component, and the workload of at least one network security product is deployed to the target security server, including: sending a load creation instruction to the target agent component corresponding to the target security server, the load creation instruction is used to instruct the target agent component to deploy the workload of at least one network security product to the target security server.

[0054] For example, after determining the target security server, the network resource security manager sends a load creation instruction to the target proxy component corresponding to the target security server. After receiving the load creation instruction, the target proxy component deploys the workload to the corresponding target security server.

[0055] Correspondingly, when load deletion is performed, a load deletion instruction may also be sent to the corresponding proxy component, so that the proxy component deletes the workload deployed in the corresponding security server based on the load deletion instruction.

[0056] The following is a detailed description of the embodiments with reference to the accompanying drawings.

[0057] like Figure 3 As shown, each security server is configured as a multi-network card model, and then the network cards of all security server nodes are interconnected with the security switch in a standardized and consistent manner, and then the agent components are deployed on all security server nodes and connected to the network security resource manager. After sending a registration request to the network security resource manager for registration, a communication connection is established to facilitate the subsequent reception of relevant instructions, reporting of server information of the security server and status information of the workload deployed on the security server, etc., and the present disclosure does not limit this. It should be understood that the subsequent process of adding a new security server is consistent with the above process, and the present disclosure will not repeat it.

[0058] Continue to refer to Figure 3 The network security resource manager can perform load orchestration based on the configuration information of the network security product and the server information reported by the proxy component, generate load orchestration instructions based on the load orchestration results and send them to the corresponding proxy components. The load orchestration instructions can be load creation instructions or load deletion instructions. The load orchestration results include the workloads that need to be created or deleted and the corresponding security servers. The configuration information of the network security product is determined based on user needs.

[0059] Furthermore, the proxy component creates and deletes workloads according to the load orchestration instructions, so that the workloads of network security products can be run or exited on the security server in an adaptive manner, achieving fast and flexible product deployment and scaling.

[0060] In a possible manner, the method also includes: obtaining the operating status of the workload of at least one network security product, performing traffic orchestration on the at least one network security product based on the operating status, and generating traffic orchestration instructions, wherein the traffic orchestration instructions are used to indicate the traffic of at least one network security product assigned to each workload; sending the traffic orchestration instructions to the traffic orchestration manager, so that the traffic orchestration manager sends the traffic orchestration instructions to the security switch, and the security switch is used to schedule the traffic of the at least one network security product to the corresponding workload for security testing according to the traffic orchestration instructions.

[0061] For example, Figure 3As shown, the network security resource manager can obtain the running status of the workload in the corresponding security server through the proxy component, and then orchestrate the traffic of the network security product based on the running status, generate traffic orchestration instructions, and send the traffic orchestration instructions to the traffic orchestration manager. The traffic orchestration manager sends the traffic orchestration instructions to the security switch so that the security switch can dispatch the traffic of the network security product to the corresponding workload for security testing based on the traffic orchestration instructions, including diversion, mirroring, and traffic load balancing, etc., which is not limited by the present disclosure.

[0062] It should be noted that load orchestration and traffic orchestration can be performed through a central manager with load orchestration and traffic orchestration functions, or through different managers respectively, and the present disclosure does not limit this.

[0063] Through the above method, all security servers of the cloud service can be interconnected with the security switch without distinction, and each security server can flexibly create and manage various workloads and traffic orchestrations according to user needs. In addition, it also supports the simultaneous operation of workloads of multiple network security products, ensuring traffic load balancing between different network security products. It not only meets the high-performance traffic data processing requirements, but also enhances the horizontal expansion capabilities of network security products and improves deployment efficiency.

[0064] Based on the same concept, the embodiment of the present disclosure provides a network security workload arrangement device, such as Figure 4 As shown, the network security workload arrangement device 400 includes: The acquisition module 401 is used to acquire target configuration information of at least one network security product corresponding to the cloud service, and acquire server information of all security servers in the first security server set; wherein the target configuration information includes the server resource amount configured for each network security product in the at least one network security product, and the server information includes the available resource amount of all security servers, and different security servers are connected to the security switch corresponding to the cloud service through a unified interface; The load orchestration module 402 is used to perform load orchestration on the workload of the at least one network security product based on the target configuration information and the server information.

[0065] Optionally, the network security workload orchestration device 400 further includes: A first acquisition submodule is configured to acquire first configuration update information for a first network security product among the at least one network security product, wherein a new server resource amount configured for the first network security product in the first configuration update information is less than a server resource amount configured for the first network security product in the target configuration information; A first determining module, configured to determine a first workload to be deleted from the workloads of the first network security product based on the first configuration update information; The deletion module is used to determine a first security server on which the first workload is deployed, and delete the first workload deployed in the first security server.

[0066] Optionally, the network security workload orchestration device 400 further includes: A second acquisition submodule is used to acquire second configuration update information for a second network security product among the at least one network security product, wherein a new server resource amount configured for the second network security product in the second configuration update information is greater than a server resource amount configured for the second network security product in the target configuration information; A second determination module, configured to determine a second workload of the second network security product to be deployed based on the second configuration update information and the server information, and to determine a second security server for deploying the second workload from the first security server set; A deployment submodule is used to deploy the second workload to the second security server.

[0067] Optionally, the second determining module is used to: In a second security server set where the workload of the second network security product is deployed, if there is a security server whose available resources are greater than or equal to the server resources required by the second workload, determining the second security server from the second security server set, wherein the first security server set includes the second security server set; If there is no security server in the second security server set whose available resources are greater than or equal to the server resources required by the second workload, the second security server is determined from other security servers in the first security server set except the second security server set.

[0068] Optionally, the network security workload orchestration device 400 further includes: A third acquisition submodule is used to obtain the operating status of the workload of the at least one network security product, perform traffic orchestration on the at least one network security product based on the operating status, and generate a traffic orchestration instruction, wherein the traffic orchestration instruction is used to indicate the traffic of the at least one network security product to which each workload is allocated; A sending module is used to send the traffic orchestration instruction to the traffic orchestration manager, so that the traffic orchestration manager sends the traffic orchestration instruction to the security switch, and the security switch is used to schedule the traffic of at least one network security product to the corresponding workload for security testing according to the traffic orchestration instruction.

[0069] Optionally, each of the security servers is deployed with a corresponding proxy component, and the load orchestration device 400 further includes: a connection module, configured to establish a communication connection with the proxy component in response to a registration request of the proxy component; The acquisition module 401 is used for: The server information of the corresponding security server sent by each of the proxy components is received to obtain the server information of all the security servers.

[0070] Optionally, the load scheduling module 402 is used to: Based on the target configuration information and the server information, a target security server for deploying the workload of the at least one network security product is determined from all the security servers, and the workload of the at least one network security product is deployed to the target security server, wherein the available resources of the target security server are greater than or equal to the server resources configured for the at least one network security product.

[0071] Optionally, each of the security servers is deployed with a corresponding proxy component, and the load orchestration module 402 is used to: A load creation instruction is sent to a target proxy component corresponding to the target security server, wherein the load creation instruction is used to instruct the target proxy component to deploy the workload of the at least one network security product to the target security server.

[0072] Based on the same concept, an embodiment of the present disclosure further provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processing device, the steps of the above-mentioned network security workload orchestration method are implemented.

[0073] Based on the same concept, the present disclosure also provides an electronic device, which may include: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the above-mentioned network security workload orchestration method.

[0074] Based on the same concept, an embodiment of the present disclosure also provides a computer program product, including a computer program, which implements the steps of the above-mentioned network security workload orchestration method when executed by a processor.

[0075] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device 500 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0076] like Figure 5 As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 to a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0077] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0078] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0079] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0080] In some embodiments, any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol) can be used for communication, and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0081] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0082] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains target configuration information of at least one network security product corresponding to the cloud service, and obtains server information of all security servers in the first security server set; wherein the target configuration information includes the server resource amount configured for each network security product in the at least one network security product, and the server information includes the available resource amount of all security servers, and different security servers are connected to the security switch corresponding to the cloud service through a unified interface; based on the target configuration information and the server information, the workload of the at least one network security product is load orchestrated.

[0083] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0084] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0085] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a module does not, in some cases, limit the module itself.

[0086] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0087] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0088] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0089] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0090] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A network security workload orchestration method, characterized in that: The method comprises: Obtain target configuration information of at least one network security product corresponding to the cloud service, and obtain server information of all security servers in the first security server set; wherein the target configuration information includes the server resource amount configured for each network security product in the at least one network security product, and the server information includes the available resource amount of all security servers, and different security servers are connected to the security switch corresponding to the cloud service through a unified interface; Based on the target configuration information and the server information, workload orchestration is performed on the workload of the at least one network security product.

2. The network security workload arrangement method according to claim 1, characterized in that: The method further comprises: Acquire first configuration update information for a first network security product among the at least one network security product, wherein a new server resource amount configured for the first network security product in the first configuration update information is less than a server resource amount configured for the first network security product in the target configuration information; Based on the first configuration update information, determining a first workload to be deleted from the workloads of the first network security product; Determine a first security server on which the first workload is deployed, and delete the first workload deployed in the first security server.

3. The network security workload arrangement method according to claim 1 or 2, characterized in that: The method further comprises: Acquire second configuration update information for a second network security product among the at least one network security product, wherein a new server resource amount configured for the second network security product in the second configuration update information is greater than a server resource amount configured for the second network security product in the target configuration information; Determine, based on the second configuration update information and the server information, a second workload of the second network security product to be deployed, and determine, from the first security server set, a second security server for deploying the second workload; The second workload is deployed to the second secure server.

4. The network security workload arrangement method according to claim 3, characterized in that: The determining, from the first set of security servers, a second security server for deploying the second workload comprises: In a second security server set where the workload of the second network security product is deployed, if there is a security server whose available resources are greater than or equal to the server resources required by the second workload, determining the second security server from the second security server set, wherein the first security server set includes the second security server set; If there is no security server in the second security server set whose available resources are greater than or equal to the server resources required by the second workload, the second security server is determined from other security servers in the first security server set except the second security server set.

5. The network security workload arrangement method according to claim 1 or 2, characterized in that: The method further comprises: Acquire the running status of the workload of the at least one network security product, perform traffic orchestration on the at least one network security product based on the running status, and generate a traffic orchestration instruction, wherein the traffic orchestration instruction is used to indicate the traffic of the at least one network security product to which each workload is allocated; The traffic orchestration instruction is sent to the traffic orchestration manager, so that the traffic orchestration manager sends the traffic orchestration instruction to the security switch, and the security switch is used to schedule the traffic of the at least one network security product to the corresponding workload for security testing according to the traffic orchestration instruction.

6. The network security workload arrangement method according to claim 1 or 2, characterized in that: Each of the security servers is deployed with a corresponding proxy component, and the method further includes: In response to a registration request of the proxy component, establishing a communication connection with the proxy component; The obtaining of server information of all security servers in the first security server set includes: The server information of the corresponding security server sent by each of the proxy components is received to obtain the server information of all the security servers.

7. The network security workload arrangement method according to claim 1 or 2, characterized in that: The performing load orchestration on the workload of the at least one network security product based on the target configuration information and the server information includes: Based on the target configuration information and the server information, a target security server for deploying the workload of the at least one network security product is determined from all the security servers, and the workload of the at least one network security product is deployed to the target security server, wherein the available resources of the target security server are greater than or equal to the server resources configured for the at least one network security product.

8. The network security workload arrangement method according to claim 7, characterized in that: Each of the security servers is deployed with a corresponding agent component, and the step of deploying the workload of the at least one network security product to the target security server includes: A load creation instruction is sent to a target proxy component corresponding to the target security server, wherein the load creation instruction is used to instruct the target proxy component to deploy the workload of the at least one network security product to the target security server.

9. A network security workload orchestration device, characterized in that: The device comprises: An acquisition module, used to acquire target configuration information of at least one network security product corresponding to the cloud service, and to acquire server information of all security servers in the first security server set; wherein the target configuration information includes the server resource amount configured for each network security product in the at least one network security product, and the server information includes the available resource amount of all security servers, and different security servers are connected to the security switch corresponding to the cloud service through a unified interface; A load orchestration module is used to perform load orchestration on the workload of the at least one network security product based on the target configuration information and the server information.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 8 are implemented.

11. An electronic device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images