Frame type security resource pool management method and device based on lightweight virtualization

Abstract

The invention discloses a frame-type security resource pool management method and device based on lightweight virtualization, the method is applied to a main control board of a frame-type device, resources of a business board are abstracted into virtual resources, a security resource pool is constructed, and after a security service request of a user is received, independent resources are scheduled from the security resource pool, so that the security service of the frame-type device is realized. And the security service module is used for operating a target virtual security service component divided from a security function module operated by each business board through a lightweight virtual technology, and providing security service for the user. Through a software and hardware combination mode, a frame type device replaces a traditional server to construct a security resource pool, and through a lightweight virtual technology, in a one-cloud multi-core scene, the composition of the security resource pool is simplified, the construction cost of the security resource pool is saved, and the construction flexibility and strong expansibility of the security resource pool are improved; and the high availability of the security resource pool is improved, and the isolation between users is realized while the reliability of the security service is improved.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a frame-type security resource pool management method and device based on lightweight virtualization. Background Art

[0002] At present, with the development of computer technology, data security has become a critical task that cannot be ignored. However, due to the increasing complexity of network security challenges, the security service costs of users are also getting higher and higher. Therefore, in order to reduce the cost of security services, especially in scenarios such as private cloud, dedicated cloud, edge station, IDC room, dedicated line, etc., users usually rent the security services of the security resource pool provided by the cloud computing platform to protect the security of cloud data.

[0003] In the prior art, the security resource pool mainly relies on the server of the cloud computing platform, that is, the operator of the cloud computing platform abstracts the server into multiple logical virtual machines, and then deploys the corresponding operating system and security services on each virtual machine. When the user rents the security service, the cloud computing platform allocates the corresponding virtual machine to the user to provide security services for the user.

[0004] However, with the increasing number of users, in order to meet the security service needs of users, the operators of cloud computing platforms need to continuously increase the number of servers, and the deployment and maintenance costs are getting higher and higher. Based on this, the present application provides a frame-type security resource pool management method and device based on lightweight virtualization. Summary of the invention

[0005] This specification provides a frame-type security resource pool management method and device based on lightweight virtualization to partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions: A frame-type security resource pool management method based on lightweight virtualization, the method is applied to a main control board of a frame-type device, the frame-type device at least includes a main control board and a service board, wherein: Determine the type and resources of each business board, and abstract the resources of each business board into virtual resources, and build a security resource pool according to the type of each business board and the virtual resources, wherein the type of each business board includes a processor architecture type; Determine a virtual security service component running on each of the service boards, wherein the virtual security service component is determined by dividing the security function module running on each of the service boards into a plurality of logical units and virtualizing each logical unit through a lightweight virtualization technology; When receiving a security service request from a user, determine at least one target virtual security service component according to the security service request, and determine independent resources from the security resource pool for running the target virtual security service component. Determine the type and resources of each service board, and abstract the resources of each service board into virtual resources, and construct a security resource pool according to the type of each service board and the virtual resources, wherein the type of each service board includes a processor architecture type; Determine a virtual security service component running on each of the service boards, wherein the virtual security service component is determined by dividing the security function module running on each of the service boards into a plurality of logical units and virtualizing each logical unit through a lightweight virtualization technology; When a security service request from a user is received, at least one target virtual security service component is determined according to the security service request, and an independent resource is determined from the security resource pool for running the target virtual security service component.

[0007] Optionally, the service boards are connected via a high-speed binding interface; Determine the type and resources of each service board, and abstract the resources of each service board into virtual resources, specifically including: Virtualizing each of the service boards into a cloud board, and determining the type and resources of the cloud board; The cloud board resources are abstracted into virtual resources.

[0008] Optionally, building a security resource pool according to the types of the service boards and the virtual resources specifically includes: For each type of service board, a security resource pool of this type is constructed according to the virtual resources of this type of service board.

[0009] Optionally, before receiving the security service request from the user, the method further includes: Pre-storing various types of service software for each service board; When the frame device is started, it accepts the service software acquisition request sent by each service board, and sends the corresponding service software to the corresponding service board according to the service software acquisition request, so that the corresponding service board runs the software corresponding to the service.

[0010] A frame-type security resource pool management method based on lightweight virtualization, the method is applied to a service board of a frame-type device, the frame-type device at least includes a main control board and a service board, and specifically includes: Determine a security function module running on itself, and divide the security function module into at least one logical unit; The logic unit is virtualized into a virtual security service component by using lightweight virtualization technology, so that when the main control board receives a security service request from a user, at least one target virtual security service component is determined according to the security service request, and an independent resource is determined from a security resource pool; A virtual device is created and configured according to the independent resource, so that the virtual device runs the target virtual security service component based on the independent resource.

[0011] Optionally, the independent resources include at least independent protocol process management resources and an independent forwarding resource pool.

[0012] This specification provides a frame-type security resource pool management device based on lightweight virtualization, which is applied to a main control board of a frame-type device. The frame-type device includes at least a main control board and several service boards, specifically including: A pooling module, used to determine the type and resources of each business board, and abstract the resources of each business board into virtual resources, and build a security resource pool according to the type of each business board and the virtual resources, wherein the type of each business board includes a processor architecture type; A determination module, used to determine the virtual security service components running on each business board, wherein the virtual security service components are determined by dividing the security function modules running on each business board into multiple logical units and virtualizing each logical unit through lightweight virtualization technology; The resource management module is used to determine at least one target virtual security service component according to the security service request when receiving a security service request from a user, and to determine an independent resource from the security resource pool for running the target virtual security service component.

[0013] This specification provides a frame-type security resource pool management device based on lightweight virtualization, which is applied to a service board of a frame-type device. The frame-type device includes at least a main control board and several service boards, specifically including: A division module, used for determining a security function module running on itself, and dividing the security function module into at least one logical unit; A virtualization module, used to virtualize the logic unit into a virtual security service component by using lightweight virtualization technology, so that when the main control board receives a security service request from a user, it determines at least one target virtual security service component according to the security service request and determines an independent resource from a security resource pool; The running module is used to create and configure a virtual device according to the independent resources, so that the virtual device runs the target virtual security service component based on the independent resources.

[0014] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned security resource pool management method is implemented.

[0015] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects: This specification provides a frame-type security resource pool management method based on lightweight virtualization. The method is applied to the main control board of the frame-type device. By abstracting the resources of the business board into virtual resources, a security resource pool is constructed. After receiving the user's security service request, independent resources are scheduled from the security resource pool to run the target virtual security service component divided from the security function module running by each business board through lightweight virtualization technology, so as to provide security services to the user.

[0016] In the above method, through the combination of software and hardware, the frame device replaces the traditional server to build a security resource pool, and through lightweight virtual technology, in the scenario of one cloud and multiple cores, the composition of the security resource pool is simplified, the construction cost of the security resource pool is saved, the flexibility and strong scalability of the construction of the security resource pool are improved, the high availability of the security resource pool is improved, and the reliability of security services is improved while achieving security isolation between users. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings: Figure 1 A schematic diagram of the secure resource pool architecture in a server-based one-cloud-multiple-core scenario provided in this specification; Figure 2 A schematic diagram of the process of a frame-type secure resource pool management method based on lightweight virtualization provided in this specification; Figure 3 A schematic diagram of the process of a frame-type secure resource pool management method based on lightweight virtualization provided in this specification; Figure 4 A schematic diagram of a lightweight virtualization technology provided in this specification; Figure 5 A schematic diagram of the interaction process between the main control board and the business board provided in this manual; Figure 6 A schematic diagram of a frame-type secure resource pool management device based on lightweight virtualization provided in this specification; Figure 7 A schematic diagram of a frame-type secure resource pool management device based on lightweight virtualization provided in this specification; Figure 8 A method corresponding to the Figure 2 or Figure 3 Schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0019] At present, with the development of computer technology, data security has become a critical task that cannot be ignored. However, due to the increasing complexity of network security challenges, the cost of security services for users is also getting higher and higher. Therefore, in order to reduce the cost of security services, especially in scenarios such as private clouds, dedicated clouds, edge stations, dedicated lines, etc., users usually rent security services from the security resource pool provided by the cloud computing platform to protect the security of cloud data. Among them, in one or more embodiments of this specification, security services include but are not limited to virtual firewalls (Virtual Firewall, vFW), virtual intrusion prevention systems (Virtual Intrusion Prevention System, vIPS), virtual network application firewalls (Virtual WebApplication Firewall, vWAF), virtual vulnerability scanning (Virtual Vulnerability Scanning", vScan), etc. The security services in the subsequent content also include but are not limited to the above content, which can be set according to actual needs, and this specification does not limit this.

[0020] In the prior art, the security resource pool mainly relies on the server of the cloud computing platform, that is, the operator of the cloud computing platform abstracts the server into multiple logical virtual machines, and then deploys the corresponding operating system and security services on each virtual machine. When the user rents the security service, the cloud computing platform allocates the corresponding virtual machine to the user to provide security services for the user.

[0021] In order to enable the cloud computing platform to support multiple different types of processor architectures, namely "one cloud, multiple cores", the software images of different processor architectures will be saved separately through the server virtualization image library, and then the central processing unit (CPU) architecture information of the corresponding server will be obtained. The virtual machine will then identify and schedule the loading of different software images to achieve compatibility with one cloud and multiple cores.

[0022] like Figure 1 As shown, Figure 1 A schematic diagram of a secure resource pool architecture in a one-cloud-multi-core scenario based on a server provided in the embodiment of the present application specification. Each virtual machine includes at least a corresponding operating system and running security services. Figure 1 In addition to the configurations contained in each virtual machine, it also includes CPU, memory, disk and other configurations. The system of the virtual machine itself will also take up a lot of resources. With the increasing number of users, in order to meet the security service needs of users, cloud computing platform operators need to continuously increase the number of servers, which not only takes up physical space, but also consumes huge power overall, and the deployment cost is getting higher and higher. In addition, with the increase in the number of server deployments, server system vulnerability patches and feature library upgrades are complex, and the difficulty of operation and maintenance is also increasing exponentially. In addition, since security components of different architectures require different images and corresponding operating systems, for example Figure 1 As shown in, since the types of server operating systems include at least X86 architecture, Advanced Reduced Instruction Set Computing Machinem (ARM), etc., that is, "one cloud, multiple cores", the processor hardware compatibility requirements of the components of the entire virtualized security resource pool are high, and the management difficulty is increased.

[0023] Based on the above content, the present application specification provides a frame-type security resource pool management method based on lightweight virtualization. The method is applied to the main control board on the frame-type device, and the frame-type device replaces the traditional security resource pool built through the server. Through lightweight virtualization technology, in the scenario of one cloud and multiple cores, the composition of the security resource pool is simplified, the construction cost of the security resource pool is saved, the flexibility and strong scalability of the construction of the security resource pool are improved, the high availability of the security resource pool is improved, and the reliability of security services is improved while achieving security isolation between users.

[0024] It should be noted that in one or more embodiments of this specification, the number of main control boards and business boards of the frame device is not limited, and can be set according to actual needs. For example, when the depth of the security resource pool needs to be increased, it can be achieved by increasing the number of business boards, or by setting at least two main control boards and using the remaining main control boards as backup boards for a certain main control board to improve the high reliability of the frame device. In addition, in one or more embodiments of this specification, the models and types of the main control boards and business boards installed on the frame device are not limited, wherein each business board runs a security function module, and each security function module corresponds to a security service.

[0025] Figure 2 A schematic diagram of a process of a frame-type secure resource pool management method based on lightweight virtualization provided in an embodiment of this specification includes the following steps: S200: Determine the type and resources of each business board, and abstract the resources of each business board into virtual resources, and build a security resource pool according to the type of each business board and the virtual resources, wherein the type of each business board includes a processor architecture type.

[0026] In one or more embodiments of the present specification, in order to improve the resource utilization of the business board, enhance the flexibility of the business board, uniformly manage and monitor the resources of the business board, and achieve resource isolation, thereby improving the high availability of the business board, the main control board may first determine the resources of each business board, and then abstract the hardware resources of each business board into virtual resources.

[0027] Specifically, the main control board can obtain the resource information of each business board, such as hardware specifications, network interfaces, health status, etc., by scanning the business boards, and then abstract the physical resources on each business board into virtual resources, such as abstracting multiple CPU cores into virtual CPUs, dividing the memory into multiple logical memory areas, and abstracting the network interface into virtual network cards, etc., based on lightweight one-virtual-many virtualization technology to achieve resource abstraction, thereby reducing virtualization overhead and providing performance close to bare metal. Then, since different types of business boards have different processing efficiency when performing security services, in order to improve the security service efficiency of the security resource pool, the main control board can build a security resource pool based on the determined virtual resources and the types of each business board. Among them, the type of business board may depend on the processor architecture type of the business board, such as X86 architecture, ARM architecture, etc.

[0028] It should be noted that in one or more embodiments of this specification, there is no restriction on how the main control board determines the resources of each business board. The resources of each business board can be determined by hardware scanning, or by obtaining a resource report sent by the business board to the main control board. Since there are many ways to determine the resources of each business board, this specification will not go into details here, and it can be set according to actual needs. In addition, in one or more embodiments of this specification, there is no restriction on what specific resources each business board may be, including but not limited to computing resources, network resources, interface resources, memory resources, etc., which can be set according to actual needs.

[0029] Furthermore, in one or more embodiments of this specification, there is no restriction on the specific method used by the main control board to implement resource abstraction and determine virtual resources, such as using containerization technology, virtual network function (VNF) slicing, etc., which are set according to actual needs, and this specification does not impose any restrictions on this.

[0030] S202: Determine a virtual security service component running on each of the business boards, wherein the virtual security service component is determined by dividing the security function module running on each of the business boards into a plurality of logical units and virtualizing each logical unit through a lightweight virtualization technology.

[0031] In order to further improve resource utilization and flexibility, the security function module running on each business board can be divided into multiple logical units, and then each logical unit can be virtualized through lightweight virtualization technology to determine each virtual security service component.

[0032] Specifically, the business board divides the security function modules that it runs into multiple logical units to realize the security pooling of the business board, and virtualizes each logical unit through lightweight virtualization technology to determine each virtual security service component, that is, the business board divides the security function modules that it runs into multiple independent virtual security service components through lightweight virtualization technology, and each virtual security service component is used to provide security services for one user. Then the main control board determines each virtualized virtual security service component.

[0033] It should be noted that in one or more embodiments of this specification, there is no limit on how the main control board determines each virtual security service component. The main control board may determine each virtual security service component by scanning each business board, or each business board may determine the global unique identifier of each virtual security service component after completing the virtualization of the security function module and send it to the main control board. Since there are many ways to use, they will not be described here in detail, and can be set according to actual needs.

[0034] S204: When receiving a security service request from a user, determining at least one target virtual security service component according to the security service request, and determining an independent resource from the security resource pool for running the target virtual security service component.

[0035] In order to provide security services to users, after receiving a security service request, the main control board determines independent resources from the constructed security resource pool according to the security service request, for running the security service provided to the user.

[0036] Specifically, the main control board obtains a security service request, and then obtains the user's configuration information and the required security service based on the security service request, and then determines independent resources from the security resource pool and a virtual security service component that can provide the security service to the user based on the configuration information and the security service, and runs them on the business board to provide security services to the user.

[0037] It should be noted that in one or more embodiments of the present specification, the specific form of the security service request is not limited, and it can be a string of code, a string of data streams, etc., which can be set according to actual needs. In addition, in one or more embodiments of the present specification, it is not limited how the main control board determines the target virtual security service component, and it can be determined according to the content of the security service request. For example, if the security service request includes the global unique identifier of the virtual security service component, the main control board can directly use the virtual security service component corresponding to the global unique identifier as the target virtual security service component. If it does not include the global unique identifier, the main control board can also randomly select a virtual security service component that can be run by the user's configuration from each virtual security service component based on the user's configuration information. It can also select the most efficient virtual security service request from the virtual security service components that can be run by the user's configuration according to the health status of each business board. Since there are many methods that can be used, they will not be repeated here, and can be set according to actual needs.

[0038] based on Figure 2 In the frame-type security resource pool management method based on lightweight virtualization shown, the method is applied to the main control board of the frame-type device. By abstracting the resources of the business board into virtual resources, a security resource pool is constructed. After receiving the user's security service request, independent resources are scheduled from the security resource pool to run the target virtual security service component divided from the security function module running by each business board through lightweight virtualization technology, so as to provide security services for the user.

[0039] In the above method, through the combination of software and hardware, the frame device replaces the traditional server to build a security resource pool, and through lightweight virtual technology, in the scenario of one cloud and multiple cores, the composition of the security resource pool is simplified, the cost of building, operating and maintaining the security resource pool is saved, the flexibility and strong scalability of the construction of the security resource pool are improved, and the high availability of the security resource pool is improved. While improving the reliability of security services, security isolation between users is achieved. In addition, resource management, resource scheduling and other management operations are performed through the main control board, and each business board and each security service are managed in a unified manner, further simplifying the composition of the security resource pool.

[0040] In addition, when the main control board builds a security resource pool, since the number of business boards is often large, in order to improve the efficiency of building the security resource pool, the business boards of the frame device can also be connected through a high-speed binding interface, and then the main control board can virtualize each business board into a cloud board card, and abstract the resources of the cloud board card instead of abstracting the resources of each business board, thereby realizing centralized management of each business board, simplifying the composition of the security resource pool, meeting the needs of the one-cloud-multiple-core scenario while simplifying management.

[0041] Furthermore, since the software between operating systems of different architectures are incompatible with each other, and the types of operating systems of business boards are often diverse, that is, "one cloud, multiple cores", in order to facilitate the subsequent scheduling of resources in the security resource pool, the main control board can also build a security resource pool of each type for each type of business board based on the virtual resources of that type of business board.

[0042] Furthermore, since different types of business boards run different types of software, the versions of software run by business boards of the same type may also be different. Therefore, in order to simplify the management of the security resource pool, the main control board can also pre-store the business software of each type of business board. When the frame device is started, it accepts the business software acquisition request sent by each business board, and sends the corresponding business software to the corresponding business board based on the business software acquisition request, so that the corresponding business board runs the software corresponding to the business.

[0043] like Figure 3 As shown, Figure 3 A schematic diagram of a process of a frame-type secure resource pool management method based on lightweight virtualization provided in an embodiment of this specification includes the following steps: S300: Determine a security function module running on itself, and divide the security function module into at least one logical unit.

[0044] S302: Virtualize the logic unit into a virtual security service component through lightweight virtualization technology, so that when the main control board receives a security service request from a user, it determines at least one target virtual security service component according to the security service request and determines independent resources from a security resource pool.

[0045] In order to further improve resource utilization and resource utilization flexibility, the security function module running on each business board can be divided into multiple logical units, and then each logical unit can be virtualized through lightweight virtualization technology to determine each virtual security service component. After the main control board obtains a security service request, it can obtain the user's configuration information and the required security service according to the security service request, and then determine independent resources from the security resource pool and the virtual security service component that can provide the security service to the user according to the configuration information and security service, and run them on the business board, thereby providing security services to the user.

[0046] Specifically, the business board divides the security function modules that it runs into multiple logical units to realize the security pooling of the business board, and virtualizes each logical unit through lightweight virtualization technology to determine each virtual security service component, that is, the business board divides the security function modules that it runs into multiple independent virtual security service components through lightweight virtualization technology, and each virtual security service component is used to provide security services for a user. For example, the security admission, access control, behavior modeling, data exchange and other security services of the virtual device are virtualized, and then different learning processes, security policy entries, etc. are allocated to it, and the software and hardware resources are independently occupied for business processing, that is, business plane virtualization.

[0047] The steps of determining independent resources and the method of the target virtual security service component are shown in the above step S304, which will not be repeated here. It should be noted that the above independent resources at least include independent protocol process management resources and independent forwarding resource pools.

[0048] S304: Create and configure a virtual device according to the independent resource, so that the virtual device runs the target virtual security service component based on the independent resource.

[0049] In order to improve the reliability of security services and achieve security isolation between users, the business board can create and configure virtual devices for running target virtual security service components based on independent resources, thereby providing security services to users.

[0050] Specifically, a virtual device is created based on the determined independent resources, and independently running protocol process management resources are configured for the virtual device. The configuration files, log processes and files corresponding to the virtual device can also be stored independently to achieve independent process restart, configuration recovery, local log storage and external sending functions, that is, management plane virtualization.

[0051] It should be noted that the business board can also store file data in a unified manner, and at the same time assign an independent administrator account to the virtual device to independently access and manage the corresponding data. The data files between the virtual devices are not visible.

[0052] In addition, the service board can also allocate an independent forwarding resource pool for the virtual device, where the forwarding resource pool includes interfaces, addresses and other resources. That is, the forwarding control of each virtual device is divided into routing table entries, Layer 2 table entries, Session, fast forwarding table, etc., and resources are allocated according to the actual networking, business logic and other conditions, which is independent of other virtual machines, that is, control plane virtualization.

[0053] based on Figure 3 In a frame-type security resource pool management method based on lightweight virtualization shown, the method is applied to the business board of the frame-type device. The target virtual security service component divided from the security function module running itself is used to provide security services for the user, so that the main control board schedules independent resources from the security resource pool constructed based on abstracting the resources of the business board as virtual resources, which are used to create and configure virtual devices based on independent resources, so that the virtual devices run the target virtual security service components based on independent resources.

[0054] In the above method, through the combination of software and hardware, the frame device replaces the traditional server to build a security resource pool, and through lightweight virtual technology, in the scenario of one cloud and multiple cores, the composition of the security resource pool is simplified, the construction cost of the security resource pool is saved, the flexibility and strong scalability of the construction of the security resource pool are improved, the high availability of the security resource pool is improved, and the reliability of security services is improved while achieving security isolation between users.

[0055] like Figure 4 As shown, Figure 4 A schematic diagram of a lightweight virtualization technology provided in an embodiment of this specification, that is, after receiving a user's security service request, management plane virtualization, control plane virtualization and business plane virtualization are implemented.

[0056] Based on the above content, the present application specification also provides a frame device, which includes at least a main control board and a service board, and the frame device is used to deploy and manage a frame security resource pool based on lightweight virtualization, such as Figure 5As shown, Figure 5 A schematic diagram of the interaction process between a main control board and a business board provided in the embodiment of the present application specification is as follows: S500: The main control board determines the type and resources of each business board, and abstracts the resources of each business board into virtual resources, and builds a security resource pool according to the type of each business board and the virtual resources, wherein the type of each business board includes a processor architecture type.

[0057] S501: The service board determines a security function module running on the service board, divides the security function module into at least one logical unit, and virtualizes the logical unit into a virtual security service component by using a lightweight virtualization technology.

[0058] S502: When receiving a security service request from a user, the main control board determines at least one target virtual security service component according to the security service request, and determines an independent resource from the security resource pool.

[0059] S503: The service board virtualizes the logic unit into a virtual security service component through lightweight virtualization technology; creates and configures a virtual device according to the independent resources, so that the virtual device runs the target virtual security service component based on the independent resources.

[0060] In addition, in order to improve the performance of security services provided to users, the service board of the device may also include at least one hardware accelerator, such as an encryption and decryption chip, a field-programmable gate array (FPGA), etc., to improve the performance of the service board and reduce the relative delay of security services.

[0061] Based on the same idea as a frame-type security resource pool management method based on lightweight virtualization provided by one or more embodiments of this specification, this specification also provides a corresponding frame-type security resource pool management device based on lightweight virtualization, such as Figure 6 shown.

[0062] Figure 6 A schematic diagram of a frame-type secure resource pool management device based on lightweight virtualization provided in this specification specifically includes: The pooling module 600 is used to determine the type and resources of each service board, and abstract the resources of each service board into virtual resources, and build a security resource pool according to the type of each service board and the virtual resources, wherein the type of each service board includes a processor architecture type; A determination module 601 is used to determine a virtual security service component running on each business board, wherein the virtual security service component is determined by dividing the security function module running on each business board into multiple logical units and virtualizing each logical unit through lightweight virtualization technology; The resource management module 602 is used to determine at least one target virtual security service component according to the security service request when receiving a security service request from a user, and to determine independent resources from the security resource pool for running the target virtual security service component.

[0063] Optionally, the business boards are connected via a high-speed binding interface, and the pooling module 600 is used to virtualize the business boards into cloud boards, determine the type and resources of the cloud boards, and abstract the cloud board resources into virtual resources.

[0064] Optionally, the pooling module 600 is used to construct a security resource pool of each type of service board according to the virtual resources of the service board of that type.

[0065] Optionally, before receiving the user's security service request, the device also includes a storage module 603, which is used to pre-store business software of each type of business board; when the frame device is started, it accepts the business software acquisition request sent by each business board, and sends the corresponding business software to the corresponding business board according to the business software acquisition request, so that the corresponding business board runs the software corresponding to the business.

[0066] Based on the same idea as a frame-type security resource pool management method based on lightweight virtualization provided by one or more embodiments of this specification, this specification also provides a corresponding frame-type security resource pool management device based on lightweight virtualization, such as Figure 7 shown.

[0067] Figure 7 A schematic diagram of a frame-type secure resource pool management device based on lightweight virtualization provided in this specification specifically includes: A division module 700 is used to determine a security function module running on itself and divide the security function module into at least one logical unit; A virtualization module 701 is used to virtualize the logic unit into a virtual security service component through lightweight virtualization technology, so that when the main control board receives a security service request from a user, it determines at least one target virtual security service component according to the security service request and determines an independent resource from a security resource pool; The running module 702 is used to create and configure a virtual device according to the independent resources, so that the virtual device runs the target virtual security service component based on the independent resources.

[0068] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 2 or Figure 3 A positioning method is provided.

[0069] This manual also provides Figure 8 The one shown corresponds to Figure 2 or Figure 3 Schematic diagram of the structure of the electronic equipment. Figure 8 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 2 or Figure 3 The invention relates to a frame-type security resource pool management method based on lightweight virtualization.

[0070] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0071] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0072] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0073] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0074] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0075] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0079] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0080] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0081] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0082] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0083] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0084] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0085] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0086] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A frame-type security resource pool management method based on lightweight virtualization, characterized in that: The method is applied to a main control board of a frame-type device, wherein the frame-type device includes at least a main control board and a service board, and specifically includes: Determine the type and resources of each business board, and abstract the resources of each business board into virtual resources, and build a security resource pool according to the type of each business board and the virtual resources, wherein the type of each business board includes a processor architecture type; Determine a virtual security service component running on each of the service boards, wherein the virtual security service component is determined by dividing the security function module running on each of the service boards into a plurality of logical units, and virtualizing each logical unit through a lightweight virtualization technology; When a security service request from a user is received, at least one target virtual security service component is determined according to the security service request, and an independent resource is determined from the security resource pool for running the target virtual security service component.

2. The method according to claim 1, characterized in that The service boards are connected via high-speed binding interfaces; the types and resources of the service boards are determined, and the resources of the service boards are abstracted into virtual resources, specifically including: Virtualizing each of the service boards into a cloud board, and determining the type and resources of the cloud board; The cloud board resources are abstracted into virtual resources.

3. The method according to claim 1, characterized in that According to the types of the service boards and the virtual resources, a security resource pool is constructed, specifically including: For each type of service board, a security resource pool of this type is constructed according to the virtual resources of this type of service board.

4. The method according to claim 1, characterized in that Before receiving the security service request from the user, the method further includes: Pre-storing various types of service software for each service board; When the frame device is started, it accepts the service software acquisition request sent by each service board, and sends the corresponding service software to the corresponding service board according to the service software acquisition request, so that the corresponding service board runs the software corresponding to the service.

5. A frame-type security resource pool management method based on lightweight virtualization, characterized in that: The method is applied to a service board of a frame-type device, wherein the frame-type device includes at least a main control board and a service board, and specifically includes: Determine a security function module running on itself, and divide the security function module into at least one logical unit; The logic unit is virtualized into a virtual security service component by using lightweight virtualization technology, so that when the main control board receives a security service request from a user, at least one target virtual security service component is determined according to the security service request, and an independent resource is determined from a security resource pool; A virtual device is created and configured according to the independent resource, so that the virtual device runs the target virtual security service component based on the independent resource.

6. The method according to claim 5, characterized in that The independent resources at least include independent protocol process management resources and an independent forwarding resource pool.

7. A frame-type security resource pool management device based on lightweight virtualization, characterized in that: The device is applied to a main control board of a frame-type device, and the frame-type device at least includes a main control board and several service boards, specifically including: A pooling module, used to determine the type and resources of each business board, and abstract the resources of each business board into virtual resources, and build a security resource pool according to the type of each business board and the virtual resources, wherein the type of each business board includes a processor architecture type; A determination module, used to determine the virtual security service components running on each business board, wherein the virtual security service components are determined by dividing the security function modules running on each business board into multiple logical units and virtualizing each logical unit through lightweight virtualization technology; The resource management module is used to determine at least one target virtual security service component according to the security service request when receiving a security service request from a user, and to determine an independent resource from the security resource pool for running the target virtual security service component.

8. A frame-type security resource pool management device based on lightweight virtualization, characterized in that: The device is applied to a service board of a frame-type device, and the frame-type device includes at least a main control board and several service boards, specifically including: A division module, used for determining a security function module running on itself, and dividing the security function module into at least one logical unit; A virtualization module, used to virtualize the logic unit into a virtual security service component by using lightweight virtualization technology, so that when the main control board receives a security service request from a user, it determines at least one target virtual security service component according to the security service request and determines an independent resource from a security resource pool; The running module is used to create and configure a virtual device according to the independent resources, so that the virtual device runs the target virtual security service component based on the independent resources.

9. A frame-type device, characterized in that: The frame device includes at least a main control board and a service board, and the frame device is used to deploy and manage a frame security resource pool based on lightweight virtualization, wherein: The main control board is used to determine the type and resources of each business board, and abstract the resources of each business board into virtual resources, and build a security resource pool according to the type of each business board and the virtual resources, wherein the type of each business board includes a processor architecture type; when receiving a user's security service request, determine at least one target virtual security service component according to the security service request, and determine an independent resource from the security resource pool; The business board is used to determine the security function module running on itself, divide the security function module into at least one logical unit, and virtualize the logical unit into a virtual security service component through lightweight virtualization technology; based on the independent resources, create and configure a virtual device so that the virtual device runs the target virtual security service component based on the independent resources.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of claims 1 to 6 is implemented.

Images