A secure service chain mapping method, electronic device and storage medium

Abstract

This invention provides a secure service chain mapping method, electronic device, and storage medium. The method involves determining a set of secure devices that meet the requirements based on the device resource needs of each secure functional node in the secure service chain; determining a set of physical links between a single secure device in a corresponding set of secure devices and a single secure device in an adjacent set of secure devices based on the link resource needs between two adjacent secure functional nodes; numbering the secure devices in each set of secure devices and the physical links in each set of physical links; generating several secure service mapping paths to form an initial population, each security service mapping path consisting of several triplets arranged sequentially, consisting of the first device number, the last device number, and the link number between devices; determining a fitness function by combining the total number of devices, average device load, and average path load of the secure service mapping paths; and using a genetic algorithm to iteratively optimize the initial population for secure service mapping paths.

Description

Technical Field

[0001] This invention relates to the field of secure service chains, specifically a secure service chain mapping method, electronic device, and storage medium. Background Technology

[0002] With the development of network technology, network devices are covering an increasingly wider range of areas, and network environments are becoming more complex. Various network attack methods are becoming increasingly sophisticated, and single security functions are no longer sufficient to cope with complex and covert network attacks. Existing network systems typically require the joint deployment of multiple security devices such as firewalls, intrusion detection systems, intrusion prevention systems, and security auditing systems. Different network traffic characteristics lead to different corresponding security protection needs, which in turn result in different security service chains—that is, sequences composed of multiple security function nodes.

[0003] Traditional, rigid network security defense architectures cannot flexibly orchestrate security devices as needed, nor can they adequately meet the diverse requirements of security service chains. By combining Software-Defined Networking (SDN) and Network Functions Virtualization (NFV), network traffic can be redirected, quickly and flexibly guiding it through the required sequence of security devices for protection, thus satisfying diverse security service chain needs. The implementation of a security service chain can be broadly divided into two steps: chain formation and mapping. The chain formation process involves orchestrating the logical order between multiple required security function nodes to form a sequence of security function nodes. The mapping process refers to mapping the virtual sequence of security function nodes onto a physical link in the underlying physical network. The physical security devices in this link can meet the corresponding security function type and computing resource requirements, while the physical link itself must meet bandwidth resource requirements.

[0004] Existing technologies typically map the functional nodes and links of a security service chain separately. First, the optimal physical security device is selected based on the resource requirements of each security functional node in the chain. Then, the optimal physical link between these selected physical security devices is selected based on the resource requirements of the links between the security functional nodes. However, in a real physical network, the performance of the optimal physical link L1 between the optimal security device A and the optimal security device B may be significantly worse than that of the optimal physical link L2 between the second-best security devices C and D. Existing technologies that map the functional nodes and links separately do not consider the overall performance of the security devices and links, leading to a suboptimal security service chain solution. Existing technologies also include solutions that map functional nodes and links simultaneously, but these typically divide the security service chain into multiple segments for sequential mapping. The first service sub-chain is mapped to the security device and the link scheme with the best overall performance. Then, the next service sub-chain is mapped based on the determined mapping scheme of the first segment. This still does not consider the overall performance of the overall mapping scheme. Summary of the Invention

[0005] The purpose of this invention is to solve the above-mentioned problems of the prior art and to provide a secure service chain mapping method, electronic device and storage medium.

[0006] In a first aspect, the present invention provides a secure service chain mapping method, the method comprising:

[0007] A secure service chain mapping method, characterized in that it includes:

[0008] S1, based on the equipment resource requirements of each security function node in the security service chain, determine the set of security devices Di, i∈(1,2,……,m) that meet the requirements in the physical security defense structure, where m represents the number of security function nodes in the security service chain;

[0009] S2, take the two sets of security devices corresponding to each pair of adjacent security function nodes in the security service chain as a security device set group. Based on the link resource requirements between two adjacent security function nodes, determine the set of physical links that meet the requirements between a single security device in one security device set and a single security device in another security device set in the corresponding security device set group, Lix,jy, j∈(1,2,……,m) and j=i+1, x∈(1,2,……,ni), ni represents the number of security devices in security device set Di, y∈(1,2,……,nj), nj represents the number of security devices in security device set Dj;

[0010] S3, assign numbers to the security devices in each security device set, and assign numbers to the physical links in each physical link set;

[0011] S4 generates several security service mapping paths to form an initial population. Each security service mapping path consists of several triples arranged sequentially, each consisting of a first device number, a last device number, and an inter-device link number. The security service mapping paths satisfy the following constraints: the first device number of the i-th triple belongs to the number set corresponding to the security device set Di; the last device number of the i-th triple belongs to the number set corresponding to the security device set Dj; and the inter-device link number of the i-th triple belongs to the number set corresponding to the physical link set Lix,jy. The first device number of a single triple is the same as the last device number of its preceding triple, and the last device number of a single triple is the same as the first device number of its following triple.

[0012] S5. The fitness function is determined by the total number of devices, average device load, and average path load of the integrated security service mapping path. The fitness of the security service mapping path is optimized by iteratively searching the initial population based on the genetic algorithm to determine the final security service mapping path. The security service mapping path changes according to the constraints in the genetic algorithm.

[0013] Preferably, the total number of devices is the sum of the number of security devices on the security service mapping path and the number of relay devices on the links between the security devices; the average device load is the average ratio of the resources occupied by all devices on the security service mapping path to the total resources; and the average path load is the average ratio of the bandwidth occupied by all links on the security service mapping path to the total bandwidth.

[0014] Preferably, numbering the security devices in a single set of security devices in step S3 includes: calculating the weight of each security device in the single set of security devices, and numbering them in ascending order of weight; the weight of each security device in the single set of security devices is... ,in , , Weights can be set as needed. This represents the ratio of resources used by the security device to total resources. This represents the average number of relay devices on all links between security device x in security device set Di and all security devices in security device set Di-1. This represents the average number of relay devices on all links between security device x in security device set Di and all security devices in security device set Di+1. This represents the average bandwidth utilization of all links between security device x in the security device set Di and all security devices in the security device set Di-1. This represents the average bandwidth utilization of all links between security device x in the security device set Di and all security devices in the security device set Di+1; in S4, an initial population is generated based on the first few sorted numbers.

[0015] Preferably, the step S4 of numbering the physical links in a single physical link set includes: calculating the weight of each physical link in the single physical link set and numbering them in descending order of weight; the weight of a single physical link is the average of the ratio of the bandwidth occupied by all its sub-links to the total bandwidth; and the step S4 generates an initial population based on the first few numbered links.

[0016] Secondly, the present invention provides an electronic device, including a memory and a computer program and a processor stored thereon, wherein the processor implements the above-described secure service chain mapping method when executing the computer program.

[0017] Thirdly, the present invention provides a storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the above-described secure service chain mapping method.

[0018] In summary, this invention offers the following advantages: Representing a security service mapping path using a series of triplets consisting of the first device number, the last device number, and the inter-device link number expands the optimization space of the genetic algorithm. Determining the fitness function by considering the total number of devices, average device load, and average path load of the security service mapping path takes into account the comprehensive performance of the devices and paths, thus facilitating the discovery of security service mapping paths with superior overall performance.

[0019] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the technical solutions of this disclosure, and to fully understand and implement the process of how this disclosure applies technical means to solve technical problems and achieve corresponding technical effects, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, not all embodiments. The embodiments of this disclosure and the various features within them can be combined with each other without conflict, and the resulting technical solutions are all within the protection scope of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort should fall within the protection scope of this disclosure.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0024] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer device such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0025] This application provides a secure service chain mapping method, such as... Figure 1 As shown, S1 involves determining the set of security devices Di, i∈(1,2,……,m), that meet the requirements in the physical security defense structure based on the device resource requirements of each security function node in the security service chain, where m represents the number of security function nodes in the security service chain. The device resource requirements may include the security function type requirements, computing resource requirements, and / or storage resource requirements of the physical security devices in the underlying physical security defense network.

[0026] like Figure 1As shown, the method of this application further includes S2, which takes the two sets of security devices corresponding to every two adjacent security function nodes in the security service chain as a security device set group. Based on the link resource requirements between two adjacent security function nodes, it determines the set of physical links Lix,jy, j∈(1,2,……,m) and j=i+1, x∈(1,2,……,ni), where ni represents the number of security devices in security device set Di, and y∈(1,2,……,nj), where nj represents the number of security devices in security device set Dj. The link resource requirements may include one or more of the following: bandwidth requirements, packet loss rate requirements, latency requirements, etc., for the physical links in the underlying physical security defense network.

[0027] like Figure 1 As shown, the method of this application also includes S3, which involves numbering the security devices in each security device set and numbering the physical links in each physical link set.

[0028] In some embodiments of this application, the security devices in the security device set are randomly numbered based on the number of security devices in the security device set, and the physical links in the physical link set are randomly numbered based on the number of physical links in the physical link set.

[0029] In some embodiments of this application, to facilitate the generation of a preferred initial population in subsequent step S4 and improve the algorithm's optimization efficiency, the numbering of security devices in a single security device set in step S3 includes: calculating the weight of each security device in the single security device set and numbering them in ascending order of weight; the weight of a single security device in the single security device set is... ,in , , Weights can be set as needed. This represents the ratio of the resources occupied by security device x in the security device set Di to the total resources. This represents the average number of relay devices on all links between security device x in security device set Di and all security devices in security device set Di-1. This represents the average number of relay devices on all links between security device x in security device set Di and all security devices in security device set Di+1. This represents the average bandwidth utilization of all links between security device x in the security device set Di and all security devices in the security device set Di-1. This represents the average bandwidth utilization of all links between security device x in the security device set Di and all security devices in the security device set Di+1.

[0030] In some embodiments of this application, in order to facilitate the generation of a preferred initial population in the subsequent step S4 and improve the algorithm's optimization efficiency, the numbering of physical links in a single physical link set in S3 includes: calculating the weight of each physical link in the single physical link set and numbering them in descending order of weight; the weight of a single physical link is the average of the ratio of the occupied bandwidth of all its sub-links to the total bandwidth.

[0031] like Figure 1 As shown, the method of this application also includes S4, generating a number of security service mapping paths to form an initial population. The security service mapping path includes a number of triples arranged in sequence, consisting of a first device number, a last device number, and an inter-device link number. The security service mapping path satisfies the following constraints: the first device number of the i-th triple belongs to the number set corresponding to the security device set Di; the last device number of the i-th triple belongs to the number set corresponding to the security device set Dj; and the inter-device link number of the i-th triple belongs to the number set corresponding to the physical link set Lix,jy. The first device number of a single triple is the same as the last device number of its preceding adjacent triple, and the last device number of a single triple is the same as the first device number of its following adjacent triple.

[0032] In some embodiments of this application, in step S4, a preferred initial population is generated based on a number of sorted numbers to improve the algorithm's optimization efficiency.

[0033] like Figure 1 As shown, the method of this application further includes S5, which determines the fitness function based on the total number of devices, average device load, and average path load of the security service mapping path, and optimizes the fitness of the security service mapping path by iteratively applying a genetic algorithm to the initial population to determine the final security service mapping path; the security service mapping path changes according to the constraints in the genetic algorithm. The total number of devices is the sum of the number of security devices on the security service mapping path and the number of relay devices on the links between each security device; the average device load is the average ratio of the resources occupied by all devices on the security service mapping path to the total resources; the average path load is the average ratio of the bandwidth occupied by all links on the security service mapping path to the total bandwidth.

[0034] This application uses a series of triplets consisting of the first device number, the last device number, and the inter-device link number to represent the security service mapping path, thus expanding the optimization space of the genetic algorithm. The fitness function is determined by considering the total number of devices, average device load, and average path load of the security service mapping path, taking into account the comprehensive performance of the devices and paths in the security service mapping path, which is beneficial for finding a security service mapping path with better overall performance.

[0035] In some embodiments of this application, optimizing the fitness of the security service mapping path based on the initial population iteration using a genetic algorithm includes:

[0036] Calculate the fitness of each security service mapping path in the population;

[0037] Several security service mapping paths are selected as parent paths through selection operations such as roulette wheel selection, tournament selection, and sorting selection.

[0038] Perform crossover and / or mutation operations on the parent paths to generate several new security service mapping paths, which will serve as the next generation population;

[0039] Determine if the termination condition of the iteration is met, such as reaching the preset number of iterations or the fitness of the population no longer changing significantly; if the termination condition is met, the algorithm ends and selects the safe service mapping path with the best fitness in the mapping population; otherwise, return to the first step to continue iterating.

[0040] In some embodiments of this application, the cross operation on the parent path includes: randomly selecting two parent paths; if there is a cross point, that is, the first device number of the triples with the same order in the two parent paths is the same, then cross is performed, that is, the triples and the triples after them in the two parent paths are replaced with each other to generate two new paths; if there is no cross point, then the two parent paths are taken as two new paths.

[0041] In some embodiments of this application, performing mutation operations on parent paths includes: for each parent path, selecting to change the inter-device link number of one or more triples with a set mutation probability, or selecting to change the first or last device number of one or more triples and changing the first or last device number of adjacent triples accordingly based on the changed triples and constraints.

[0042] In some embodiments of this application, in order to balance the stability and diversity of the population, prevent frequent mutations in the population from causing frequent changes in fitness that affect the optimization efficiency, and prevent the algorithm from prematurely converging to a local optimum, when performing mutation operations to change the inter-device link number, first device number, or last device number of the parent path, the physical link number / security device number ranked earlier in the corresponding physical link set / security device set is selected with a higher probability to replace the inter-device link number / first device number or last device number in the parent path to be changed, and the physical link number / security device number ranked later is selected with a lower probability to replace the inter-device link number / first device number or last device number in the parent path to be changed.

[0043] This application also provides an electronic device, including a memory and a processor, which can be connected via a bus or other means. The memory can be used to store software programs, computer programs, and modules, such as the program / module corresponding to the aforementioned secure service chain mapping method; the processor implements the aforementioned secure service chain mapping method by executing the computer programs and modules in the memory.

[0044] In some embodiments, the processor may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits packaged with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips.

[0045] The memory includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, disk, optical disk, etc.

[0046] This application also provides a computer-readable storage medium storing computer-executable instructions. When the computer-executable instructions are loaded and executed by a processor, the above-described secure service chain mapping method is implemented.

[0047] The processor may include, but is not limited to, one or more processors or microprocessors. Each processor may be implemented as an Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor, or other electronic component, for performing the steps of the methods described in the embodiments above.

[0048] Computer-readable storage media can be implemented by any type of volatile or non-volatile storage device or a combination thereof. Computer-readable storage media may include, but are not limited to, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, and computer storage media (e.g., hard disks, floppy disks, solid-state drives, removable disks, Blu-ray discs, etc.).

[0049] In the embodiments provided in this disclosure, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using dedicated hardware-based apparatus that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0050] While the embodiments disclosed herein are as described above, the foregoing content is merely for the purpose of facilitating understanding of this disclosure and is not intended to limit this disclosure. Any person skilled in the art to which this disclosure pertains may make any modifications and changes in form and detail of the implementation without departing from the spirit and scope of this disclosure; however, the scope of patent protection of this disclosure shall still be determined by the scope defined in the appended claims.

Claims

1. A secure service chain mapping method, characterized in that, include: S1, based on the device resource requirements of each security function node in the security service chain, determine the set D of security devices that meet the requirements in the physical security defense structure. i , i∈(1,2,……,m), m represents the number of security function nodes in the security service chain; S2, Take the two sets of security devices corresponding to every two adjacent security function nodes in the security service chain as a security device set group. Based on the link resource requirements between two adjacent security functions, determine the set L of physical links that meet the requirements between a single security device in one security device set and a single security device in another security device set within the corresponding security device set group. ix,jy j∈(1,2,……,m) and j=i+1, x∈(1,2,……,n) i ), n i D represents the set of safety devices. i The number of safety devices in the system, y∈(1,2,……,n) j ), n j D represents the set of safety devices. j The number of safety devices in the system; S3, assign numbers to the security devices in each security device set, and assign numbers to the physical links in each physical link set; S4, generate several security service mapping paths to form an initial population. Each security service mapping path consists of several triples arranged sequentially, consisting of the first device number, the last device number, and the inter-device link number. The security service mapping paths satisfy the following constraint: the first device number of the i-th triple belongs to the security device set D. i The corresponding set of numbers, the tail device number of the i-th triple belongs to the set of security devices D. j The corresponding set of numbers, the inter-device link number of the i-th triple belongs to the physical link set L. ix,jy The corresponding set of numbers; the first device number of a single triplet is the same as the last device number of its preceding triplet, and the last device number of a single triplet is the same as the first device number of its following triplet. S5. The fitness function is determined by the total number of devices, average device load, and average path load of the integrated security service mapping path. The fitness of the security service mapping path is optimized by iteratively searching the initial population based on the genetic algorithm to determine the final security service mapping path. The security service mapping path changes according to the constraints in the genetic algorithm.

2. The secure service chain mapping method according to claim 1, characterized in that, The total number of devices is the sum of the number of security devices on the security service mapping path and the number of relay devices on the links between each security device; the average device load is the average ratio of the resources occupied by all devices on the security service mapping path to the total resources; the average path load is the average ratio of the bandwidth occupied by all links on the security service mapping path to the total bandwidth.

3. The secure service chain mapping method according to claim 1, characterized in that, The step S3, numbering the security devices in a single set of security devices, includes: calculating the weight of each security device in the single set of security devices, and numbering them in ascending order of weight; the weight of each security device in the single set of security devices is... ,in , , Weights can be set as needed. This represents the ratio of resources used by the security device to total resources. The set of security devices D represents i Safety equipment x and safety equipment set D i-1 The average number of relay devices on all links between all security devices in the system. The set of security devices D represents i Safety equipment x and safety equipment set D i+1 The average number of relay devices on all links between all security devices in the system. The set of security devices D represents i Safety equipment x and safety equipment set D i-1 The average bandwidth utilization of all links between all security devices in the system. The set of security devices D represents i Safety equipment x and safety equipment set D i+1 The average bandwidth utilization of all links between all security devices; in step S4, an initial population is generated based on the first few sorted numbers.

4. The secure service chain mapping method according to claim 1, characterized in that, The step S4 of numbering the physical links in a single physical link set includes: calculating the weight of each physical link in the single physical link set and numbering them in descending order of weight; the weight of a single physical link is the average of the ratio of the bandwidth occupied by all its sub-links to the total bandwidth; and the step S4 of generating an initial population based on the first few numbered links.

5. An electronic device, comprising a memory and a computer program and processor stored thereon, characterized in that, When the processor executes the computer program, it implements a secure service chain mapping method as described in any one of claims 1-4.

6. A storage medium, characterized in that, The storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement a secure service chain mapping method as described in any one of claims 1-4.

Images