Unified scheduling method based on virtual network element and physical equipment

Abstract

The invention relates to a unified scheduling method based on virtual network elements and physical equipment, and belongs to the field of network security. The method provided by the invention comprises a physical network element definition and service chain unified arrangement method; physical network element definition: defining the network into four types: an internal management network, a service network, a service chain series network and a service chain bypass network; the interfaces are also divided into four types: an internal management interface, a service network interface, a series interface and a bypass interface; physical network elements only care about networks and interfaces of series or bypass services; the service chain unified arrangement method comprises the following steps: abstracting two objects based on the condition that a virtual network element and a physical network element have differences, and extracting attributes of an intersection part in the two objects to form a new public network element object. According to the method, a user neglects two equipment forms, only pays attention to the safety protection capability of the two equipment forms, and uniformly uses a service chain for flexible combination, so that the operation and maintenance complexity is greatly reduced.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to a unified scheduling method based on virtual network elements and physical devices. Background Art

[0002] At present, there are a large number of virtual network elements and physical network elements in the network security service system. The two types of network elements cannot be orchestrated. Only physical network elements or virtual network elements can be orchestrated separately, which not only wastes resources but also creates huge obstacles for management and maintenance. How to mix and orchestrate virtualized network elements and physical network elements is a difficult problem. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is how to provide a unified scheduling method based on virtual network elements and physical devices to solve the problem of mixed scheduling of virtualized network elements and physical network elements.

[0005] (II) Technical solution

[0006] In order to solve the above technical problems, the present invention proposes a unified scheduling method based on virtual network elements and physical devices, the method comprising: a unified scheduling method for physical network element definition and service chain;

[0007] Definition of physical network elements: Networks are defined into four categories: internal management network, business network, service chain serial network and service chain bypass network; interfaces are also divided into four categories: internal management interface, business network interface, serial interface and bypass interface; physical network elements only care about the networks and interfaces of serial or bypass services;

[0008] Unified service chain orchestration method: Based on the differences between virtual network elements and physical network elements, the two objects are abstracted, and the attributes of the intersection of the two objects are extracted to form a new common network element object; for the service chain function, this new network element object is orchestrated, and the previous virtual network element objects and physical network element objects are no longer used. It is no longer distinguished whether the orchestration is a virtual network element or a physical network element. When distributing traffic, only the series connection or bypass interface of the network element object is concerned.

[0009] (III) Beneficial effects

[0010] The present invention proposes a unified scheduling method based on virtual network elements and physical devices. The present invention proposes a unified scheduling method based on virtual network elements and physical devices, which is an innovative method mainly proposed to solve the problem that virtual network elements and physical devices cannot be uniformly scheduled. Compared with the current situation that traditional scheduling technology can only schedule virtual network elements alone, or can only schedule physical devices alone, this method can abstract both virtual network elements and physical devices into a new security service object, allowing users to ignore the two device forms and only focus on their security protection capabilities, and use service chains for flexible combination, which greatly reduces the complexity of operation and maintenance, and can reuse old equipment and solve the problem that some equipment does not have a virtualized form. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a schematic diagram of the same arrangement of virtual network elements and physical devices;

[0012] Figure 2 Classify schematic diagrams for software-defined networks;

[0013] Figure 3 Define a graph for a virtual network element object;

[0014] Figure 4 Define graphs for physical network element objects;

[0015] Figure 5 Define a graph for a new network element object. DETAILED DESCRIPTION

[0016] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0017] The present invention proposes a unified scheduling method based on virtual network elements and physical devices, which is an innovative method mainly proposed to solve the problem that virtual network elements and physical devices cannot be uniformly scheduled.

[0018] like Figure 1 As shown in the figure, virtual network elements are to be connected to the corresponding virtual network when they are created, and then orchestrated and used, while physical devices are to be wired in the physical network and are not related to the virtual network. If you want to orchestrate the physical devices in the physical network and the virtual network elements in the virtual network at the same time to form a mixed virtual and real service chain, you need to reclassify and define the network, analyze the use of virtual network elements and physical devices, define the characteristics of physical network elements, and then combine the service chain to conduct compatibility analysis and design.

[0019] 4.1 Definition of Physical Network Elements

[0020] In order to design and define physical network elements, it is necessary to first sort out the main deployment and use methods of physical security devices in the network. In the business network, physical security devices are mainly divided into two-layer access and three-layer access. For the service chain of three-layer access, the devices are generally connected together based on routing, and the traffic is transmitted to the physical security device through policy routing. This access method requires the corresponding three-layer network and IP of the physical security device to logically string the physical security device into a service chain. This method is complex and inflexible to use. If you want to adjust the composition of the service chain during the process, it is even more difficult to do so, so three-layer access is basically not considered. Two-layer access is more flexible and convenient, and is divided into serial access and bypass access. Different physical security devices may use different access methods. Combined with the unified use of compatible virtual network elements, the situation of software-defined networks is sorted out.

[0021] like Figure 2 , defines the network into four categories: internal management network, business network, service chain series network, service chain bypass (mirror) network. Interfaces are also divided into four categories: internal management interface, business network interface, series interface (a pair), bypass (mirror) interface.

[0022] The network is divided into four categories based on different demand scenarios.

[0023] Internal management network: The internal management network is a network used for internal management. It is not externally perceived and is used to manage VNFs, including password-free jumps, VNF configuration initialization (network), and centralized management. This network is required for virtual network elements, but not for physical network elements.

[0024] Business network: Business network is the network business network connected to the user, mainly used to actively provide security services based on the three-layer network. For example, the vulnerability scanning system connects to the customer's business network through this network for scanning. This network is required for virtual network elements, but not for physical network elements. There can be multiple networks. Each business network will have an interface connected to it in the VNF.

[0025] Service chain serial network: The service chain serial network is used to arrange network elements and form a logical serial network. The reason why the service chain does not need routing for serial connection is that multiple VNFs are serially connected through the second-layer access method. It does not need to achieve the effect of a single service chain by configuring multiple three-layer networks and combining policy routing like other service chains. This network is selected according to the use of network elements. Network elements that need security protection on the serial chain need to be configured.

[0026] Service chain bypass network: The service chain bypass network is specifically used for traffic mirroring, which is used to copy the specified traffic and distribute it to the bypass audit, analysis, and statistics network elements in the side chain of the service chain. This network is also selected according to the use of the network element. The network elements that need to perform statistical analysis on the bypass chain need to be configured.

[0027] According to the above four types of network definitions, there are also four corresponding types of interfaces.

[0028] Internal management interface: The internal management network is mandatory for virtual network elements, so there must be an internal management interface in the VNF. The default is the first interface, DHCP mode, and it will automatically obtain an internal network IP after startup. This IP will be used for password-free jumps and RESTAPI configuration, etc., but physical network elements do not need it. The internal management interface is Figure 2 The e0 interface in the network element.

[0029] Service network interface: Since service network is mandatory for virtual network elements and there is at least one, there will be an interface for each service network in the VNF. Service-oriented VNFs will provide relevant security protection through this interface, such as vulnerability scanning, SSLVPN, etc., which is also not required for physical network elements. The service network interface is Figure 2 The e1 interface in the VNF in .

[0030] Serial interface: If you want to orchestrate the network element into the serial chain of the service chain, you need to select the serial network when creating or defining the network element. There will be a pair of interfaces in the virtual network element, and the physical network element needs to select a pair of interfaces on the physical device as the serial interface. This pair of interfaces is required to be included in the bridge for Layer 2 transmission, one interface in and one interface out. The service chain orchestration engine will send the specified traffic to the serial interface of the corresponding network element in sequence according to the diversion strategy and service chain strategy. The traffic received from the serial interface will find the next network element according to the service chain strategy and repeat the above actions until the last network element in the serial chain of the service chain has processed the traffic and then forwarded it. The serial interface is Figure 2 The e2 and e3 interfaces in the VNF. e2 is the serial input interface, and e3 is the serial output interface.

[0031] Bypass interface: If you want to orchestrate the VNF into the bypass chain of the service chain, you need to select the bypass network when creating or defining the network element. There will be an additional corresponding interface in the VNF, and the physical network element needs to select an interface on the physical device as the bypass interface. The interface needs to be set to bypass mode to receive and process the mirrored traffic. The service chain orchestration engine will copy the specified traffic according to the diversion strategy and service chain strategy, and send it to the bypass interface of each network element in the bypass chain. The bypass interface is Figure 2The e4 interface in the VNF in Figure 1.

[0032] According to the above definition and analysis, there are significant differences between physical network elements and virtual network elements. Physical network elements only care about the networks and interfaces of serial or bypass services. Physical devices do not require any customized development and can be directly managed by the service chain, thereby better achieving the effect of reusing old devices.

[0033] 4.2 Unified Service Chain Orchestration Method

[0034] Based on the differences between virtual network elements and physical network elements, it is necessary to abstract the two objects, extract the attributes of the intersection of the two objects, and form a new common network element object. For the service chain function, it is necessary to change to orchestrate this new network element object, no longer use the previous virtual network element object and physical network element object, no longer distinguish whether the orchestration is virtual network element or physical network element, and when distributing traffic, only care about the series connection or bypass interface of the network element object, so as to achieve compatibility.

[0035] like Figure 3 In addition to some of its own characteristics, virtual network elements also include network-related attributes. Network-related attributes include internal management networks, business networks, series networks, bypass networks, and corresponding network interface information.

[0036] like Figure 4 The attributes of physical network elements are fewer than those of virtual network elements. In addition to their own characteristics, they also include network-related attributes. The network-related attributes only include the series network, bypass network, and corresponding interface information of the corresponding network.

[0037] like Figure 5 , virtual network element objects and physical network element objects are finally converted into new network element objects, which extract the attributes of the intersection part and refine the four types of networks and the corresponding four types of interfaces to form independent interface objects. After the service chain references the new network element object, the compatibility of virtual and physical network elements has been completed. In subsequent use, there is no need to consider the relevant differences. You only need to define the required virtual network elements and physical network elements, and directly reference them in the service chain to form a virtual-real hybrid service chain to achieve the corresponding security protection effect, simple operation and high flexibility.

[0038] The present invention proposes a unified scheduling method based on virtual network elements and physical devices, which is mainly an innovative method for solving the problem that virtual network elements and physical devices cannot be uniformly scheduled. Compared with the current situation that traditional scheduling technology can only schedule virtual network elements alone, or can only schedule physical devices alone, this method can abstract both virtual network elements and physical devices into a new security service object, allowing users to ignore the two device forms and only focus on their security protection capabilities, and use service chains for flexible combination, which greatly reduces the complexity of operation and maintenance, and can reuse old equipment and solve the problem that some equipment does not have a virtualized form.

[0039] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for unified scheduling based on virtual network elements and physical devices, characterized in that: The method includes: physical network element definition and service chain unified orchestration method; Definition of physical network elements: Networks are defined into four categories: internal management network, business network, service chain serial network and service chain bypass network; interfaces are also divided into four categories: internal management interface, business network interface, serial interface and bypass interface; physical network elements only care about the networks and interfaces of serial or bypass services; Unified service chain orchestration method: Based on the differences between virtual network elements and physical network elements, the two objects are abstracted, and the attributes of the intersection of the two objects are extracted to form a new common network element object; for service chain functions, this new network element object is orchestrated, and the previous virtual network element objects and physical network element objects are no longer used. It is no longer distinguished whether the orchestration is a virtual network element or a physical network element. When distributing traffic, only the series connection or bypass interface of the network element object is concerned.

2. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: The internal management network is a network used for internal management. It is not externally perceived and is used to manage VNFs, including password-free jumps, VNF configuration initialization, and centralized management. This network is required for virtual network elements but not for physical network elements.

3. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: The service network is connected to the user's network service network, which is used to actively provide security services based on the three-layer network. This network is required for virtual network elements, but not for physical network elements. There can be multiple network elements, and each service network will have an interface connected to it in the VNF.

4. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: The service chain serial network is used to orchestrate network elements and form a logical serial network. The service chain does not require routing for serial connection because multiple VNFs are connected in series through Layer 2 access. This network is selected based on the way the network elements are used. Network elements that require security protection on the serial chain need to be configured.

5. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Service chain bypass network: The service chain bypass network is specifically used for traffic mirroring, which is used to copy the specified traffic and distribute it to the bypass audit, analysis, and statistics network elements in the adjacent chains in the service chain; This network is also selected based on how the network elements are used. The network elements that need to perform statistical analysis on the bypass chain need to be configured.

6. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Internal management interface: The internal management network is mandatory for virtual network elements, so there must be an internal management interface in the VNF. The default is the first interface, DHCP mode, and it will automatically obtain an internal network IP after startup. This IP will be used for password-free jumps and RESTAPI configuration delivery, but it is not required for physical network elements.

7. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Service network interface: Since service network is mandatory for virtual network elements and there is at least one, there will be an interface for each service network in the VNF. Service-oriented VNFs will provide relevant security protection through this interface, which is not required for physical network elements.

8. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Serial interface: If you want to orchestrate the network element into the serial chain of the service chain, you need to select the serial network when creating or defining the network element. There will be a pair of interfaces in the virtual network element, and the physical network element needs to select a pair of interfaces on the physical device as the serial interface. This pair of interfaces is required to be included in the bridge for Layer 2 transmission, with one interface in and one interface out. The service chain orchestration engine will send the specified traffic to the serial interface of the corresponding network element in sequence according to the diversion strategy and service chain strategy, and the traffic received from the serial interface will find the next network element according to the service chain strategy, and repeat the above actions until the last network element in the serial chain of the service chain has processed the traffic and then forwarded it.

9. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Bypass interface: If you want to orchestrate the VNF into the bypass chain of the service chain, you need to select the bypass network when creating or defining the network element. There will be an additional corresponding interface in the VNF, and the physical network element needs to select an interface on the physical device as the bypass interface. The interface needs to be set to bypass mode to receive and process the mirrored traffic; The service chain orchestration engine will copy the specified traffic according to the traffic diversion strategy and service chain strategy, and send it to the bypass interface of each network element in the bypass chain.

10. The method for unified scheduling based on virtual network elements and physical devices according to any one of claims 1 to 9, characterized in that: When the service chain is uniformly orchestrated, In addition to some of its own attributes, virtual network elements also include network-related attributes, which include internal management network, service network, serial network, bypass network, and corresponding network interface information; In addition to its own characteristics, the physical network element also includes network-related attributes, and the network-related attributes only include the corresponding interface information of the series network, bypass network, and corresponding network; Virtual network element objects and physical network element objects are eventually converted into new network element objects, which extract and retain the attributes of the intersection part, and refine the four types of networks and the corresponding four types of interfaces to form independent interface objects. After the service chain references the new network element object, the compatibility of virtual and physical network elements has been completed. In subsequent use, there is no need to consider the relevant differences. You only need to define the required virtual network elements and physical network elements and directly reference them in the service chain to form a virtual-real hybrid service chain.

Images