Network boundary security stack system

Abstract

The invention relates to a network boundary security stack system, and belongs to the field of network security. According to the system, a layered, embedded and multi-dimensional integrated safety protection design scheme is adopted; layering refers to that a software definition architecture is adopted, and the system is divided into a boundary access layer, a security resource layer, a core exchange layer and an operation and maintenance management and control layer; the embedding means that the base of the multi-source heterogeneous network element pool of the security resource layer is embedded and integrated in the business process from the bottom layer architecture and the data transmission level; the multi-dimension refers to that in a core exchange area, a service chain flexible arrangement method and a full-scene link communication keeping method are adopted to realize multi-dimension refined security control of network traffic, break the constraint of one-dimensional traffic processing, enter a traffic multi-dimensional space and realize high-speed concurrency of different traffic security processing. According to the system, by integrating multiple intelligent technologies, the problems existing in a traditional boundary protection scheme are effectively solved, and a powerful guarantee is provided for the security and management efficiency of a network boundary.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to a network boundary security stack system. Background Art

[0002] Traditional border protection solutions face many challenges in dealing with the current network environment and business needs, especially in terms of numerous devices, severe stacking, poor scalability, and complex management and operation.

[0003] With the continuous expansion of enterprise business and the increase in network security needs, traditional border protection solutions often require the deployment of a large number of security devices, such as firewalls, intrusion detection systems (IDS / IPS), VPN devices, etc. The stacking and redundancy between these devices not only increase the cost of the enterprise, but also increase the complexity of the network structure, making network management and maintenance more difficult. In addition, due to compatibility and interoperability issues between different devices, network performance may also decline and security risks may increase.

[0004] Traditional border protection solutions often use static, fixed network architectures, which are difficult to adapt to the rapidly changing needs of enterprise business. When enterprises need to expand the network scale or add new business applications, they often need to purchase new security equipment and reconfigure and deploy them, which not only increases the cost of the enterprise, but also prolongs the service launch cycle. At the same time, due to the poor scalability of traditional solutions, existing network resources and security equipment may not be fully utilized, resulting in resource waste and performance bottlenecks.

[0005] Traditional border protection solutions require administrators to configure and manage multiple security devices separately, which not only increases the workload of administrators, but also easily leads to configuration errors and security risks. Since the management interface and configuration methods of different devices are different, administrators need to master a variety of skills and knowledge to perform effective management and maintenance. At the same time, as the business of enterprises continues to develop and change, security policies and configurations also need to be constantly adjusted and optimized, which makes management and operation work more complicated and cumbersome.

[0006] The above-mentioned problems become problems that need to be solved. Summary of the invention

[0007] 1. Technical issues to be resolved

[0008] The technical problem to be solved by the present invention is how to provide a network border security stack system to solve the problems of traditional border protection solutions in terms of numerous devices, serious stacking, poor expansion capability, and complex management and operation.

[0009] (II) Technical solution

[0010] In order to solve the above technical problems, the present invention proposes a network boundary security stack system, which adopts a layered, embedded, multi-dimensional integrated security protection design scheme based on the concept of integrated security protection;

[0011] Layering refers to the use of software-defined architecture to divide the system into: border access layer, security resource layer, core switching layer and operation and maintenance control layer; the border access layer includes the next-generation border protection equipment, and the security resource layer virtualizes the border protection equipment in the border access area into a multi-source heterogeneous network element pool base through network resource virtualization technology, computing resource virtualization technology, and storage resource virtualization technology; the core switching area realizes multi-dimensional and detailed security control of network traffic; the operation and maintenance control layer realizes unified operation and management;

[0012] Embedding means that through integrated design, the multi-source heterogeneous network element pool base at the security resource layer adopts the network traffic unsupervised anomaly detection method based on the improved Transformer reconstruction model, the encrypted traffic anomaly rapid detection method based on the plaintext traffic characteristics, and the infrastructure as code implementation method of the security resource pool, so as to be embedded and integrated in the business process from the underlying architecture and data transmission level;

[0013] Multi-dimensional refers to the use of flexible service chain orchestration methods and full-scenario link security methods in the core switching area to achieve multi-dimensional and detailed security control of network traffic, break the constraints of one-dimensional traffic processing, enter the multi-dimensional space of traffic, and achieve high-speed concurrency of different traffic security processing;

[0014] Among them, the flexible service chain orchestration methods include: orchestration methods for decrypted traffic service chains based on blockchain and deep reinforcement learning, optimization methods based on software-defined orchestration technology, unified scheduling methods based on virtual network elements and physical devices, and automatic orchestration and deployment methods for security service chains based on particle swarm algorithms. The above methods can be used to achieve flexible orchestration of service chains in different situations or scenarios.

[0015] The full-scenario link maintenance method uses multiple intelligent link maintenance methods to ensure that the border security stack system can respond quickly and maintain network quality even when failures occur at all levels of the network;

[0016] A unified management method for intelligent security capabilities is also provided at the operation and maintenance control layer. The unified management method for intelligent security capabilities enables the system to achieve standardized and normalized unified management of multi-category heterogeneous networks.

[0017] (III) Beneficial effects

[0018] The present invention proposes a network boundary security stack system. The present invention designs and implements a next-generation network boundary security stack system. The system adopts the above-mentioned technology to help optimize network performance, reduce data transmission delays and errors, and thus provide users with a smoother and more secure network experience.

[0019] The network border security stack system of the present invention effectively solves the problems existing in traditional border protection solutions by integrating multiple intelligent technologies, and provides a strong guarantee for the security and management efficiency of the network border. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is the overall architecture diagram of the network boundary security stack system of the present invention;

[0021] Figure 2 This is the flow chart for forwarding business traffic in normal scenarios;

[0022] Figure 3 This is a schematic diagram of hardware bypass;

[0023] Figure 4 This is a schematic diagram of software Bypass;

[0024] Figure 5 This is a schematic diagram of the service chain Bypass;

[0025] Figure 6 This is a schematic diagram of the security network element Bypass;

[0026] Figure 7 Initialize the flow chart for unified configuration management of network elements;

[0027] Figure 8 Configure differentiated redundancy management flow chart for network elements;

[0028] Fig. 9 Provide a technical architecture diagram for software-defined service chain orchestration;

[0029] Fig.10 This is the NSH data structure diagram;

[0030] Fig.11 It is a schematic diagram of dynamic EFC information synchronization of the service chain;

[0031] Fig.12 It is a diagram showing the difference between data transmission paths between network elements across nodes and within nodes;

[0032] Fig.13 It is a schematic diagram of the path of the round-robin scheduling algorithm based on the resource board in the prior art;

[0033] Fig.14 The optimized resource board sequence priority scheduling path diagram of the present invention;

[0034] Fig.15 This is a flowchart of priority scheduling based on network element ID;

[0035] Fig.16 This is a schematic diagram of the same network element ID running on the same resource board;

[0036] Fig.17 This is the hardware logic architecture diagram of the security stack;

[0037] Fig.18 This is a schematic diagram of the arrival of the first message Pkt1 in the system;

[0038] Fig.19 This is a schematic diagram of M1 (pushrule1)->R1;

[0039] Fig. 20 The diagram is Pkt1: R1 (rule1 hit) -> V1 -> V2 -> Port1;

[0040] Fig.21 This is a schematic diagram of subsequent message forwarding;

[0041] Fig. 22 This is a schematic diagram of V2->R1->M1->R2->V3;

[0042] Fig.23 This is a schematic diagram of V2->R1->R2–>V3;

[0043] Fig.24 This is a schematic diagram of network elements after optimization at different resource nodes;

[0044] Fig.25 It is a schematic diagram of the same arrangement of virtual network elements and physical devices;

[0045] Fig.26 Classify schematic diagrams for software-defined networks;

[0046] Fig. 27 Define a graph for a virtual network element object;

[0047] Fig.28 Define graphs for physical network element objects;

[0048] Fig.29 Define graphs for new network element objects;

[0049] Fig.30 Maintain process diagrams for the security resource pool infrastructure;

[0050] Fig.31 Recovering process flow diagrams for secure resource pool infrastructure;

[0051] Fig.32This is a schematic diagram of the automatic orchestration and deployment method of security service chain based on particle swarm algorithm;

[0052] Fig.33 This is a schematic diagram of the average total bandwidth consumption under the three methods;

[0053] Fig.34 Schematic diagram of the success rate of security service chain requests under three methods;

[0054] Fig.35 This is a comparison chart of the maximum throughput under the two models;

[0055] Fig.36 The following is a comparison chart of the maximum number of new connections and concurrent connections under the two models. DETAILED DESCRIPTION

[0056] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0057] In order to solve the problems of traditional border protection solutions in terms of numerous devices, serious stacking, poor scalability, and complex management and maintenance, this invention proposes an innovative network border security stack system. The overall system architecture is as follows Figure 1 shown.

[0058] The present invention designs and implements a next-generation network border security stack system, which implements the next-generation network border protection technology. For the next-generation network border protection technology, the present invention adopts a layered, embedded, multi-dimensional integrated security protection design scheme based on the concept of integrated security protection.

[0059] Layering refers to the use of software-defined architecture to divide the system into: border access layer, security resource layer, core switching layer and operation and maintenance control layer, solidify the internal relationships of the system, simplify the external relationships of the system, and standardize the system operation and management mode; the border access layer includes the next-generation border protection equipment, and the security resource layer virtualizes the border protection equipment in the border access area into a multi-source heterogeneous network element pool base through network resource virtualization technology, computing resource virtualization technology, and storage resource virtualization technology; the core switching area realizes multi-dimensional and detailed security control of network traffic; the operation and maintenance control layer realizes unified operation and management.

[0060] Embedding means that through integrated design, the multi-source heterogeneous network element pool base at the security resource layer adopts the network traffic unsupervised anomaly detection method based on the improved Transformer reconstruction model, the encrypted traffic anomaly rapid detection method based on the plaintext traffic characteristics, and the infrastructure as code implementation method of the security resource pool, so as to embed and integrate network access, intrusion detection, anti-virus, WAF protection, access control, version control and other capabilities in the business process from the underlying architecture and data transmission level;

[0061] Among them, through the infrastructure as code implementation method of the security resource pool, after the infrastructure as code is implemented in the security resource area, the security resource pool will have the ability to perform rollbacks for specific network elements and the entire security resource pool, thereby supporting the security resource pool to quickly stop losses after a failure occurs. At the same time, the security resource pool can also rely on this capability to conveniently restore the fault site and verify the fault recovery plan in subsequent fault drills.

[0062] Multi-dimensional refers to the use of flexible service chain arrangement methods, full-scenario link security methods, multi-level redundant architectures, and high-performance linear expansion methods in the core switching area to achieve multi-dimensional and detailed security control of network traffic, break the constraints of one-dimensional traffic processing, enter the multi-dimensional space of traffic, achieve high-speed concurrency of different traffic security processing, and comprehensively improve the processing efficiency of the integrated system. Among them, the multi-level redundant architecture and high-performance linear expansion methods use existing technologies, and the improvements of the present invention lie in the flexible service chain arrangement method and the full-scenario link security method;

[0063] Flexible service chain orchestration methods include: orchestration methods for decrypted traffic service chains based on blockchain and deep reinforcement learning, optimization methods based on software-defined orchestration technology, unified scheduling methods based on virtual network elements and physical devices, and automatic orchestration and deployment methods for security service chains based on particle swarm algorithm. The above methods can be used to achieve flexible orchestration of service chains in different situations or scenarios.

[0064] The full-scenario link maintenance method adopts multiple intelligent link maintenance methods to ensure that even when failures occur at various levels of the network, the border security stack system can respond quickly and maintain network quality, thereby ensuring the continuity and stability of critical services.

[0065] In addition, a unified management method for intelligent security capabilities is provided at the operation and maintenance control layer. The unified management method for intelligent security capabilities enables the border security stack system to achieve standardized and standardized unified management of multi-category heterogeneous networks. This unified management method not only reduces the complexity and difficulty of operation and maintenance, but also significantly improves the efficiency and capabilities of management and operation, allowing network administrators to more easily cope with various security challenges.

[0066] Among them, a network traffic anomaly detection method based on reconstruction model (CN202311791348.2), a method for rapid detection of encrypted traffic anomalies based on plaintext traffic features (CN202410347186.1), and a decrypted traffic service chain orchestration method based on blockchain and deep reinforcement learning (CN202410244760.0) have all been patented. The contents of these patents are hereby introduced into the present invention.

[0067] In summary, the technologies of the present invention help optimize network performance, reduce data transmission delays and errors, and thus provide users with a smoother and more secure network experience.

[0068] The network border security stack system of the present invention effectively solves the problems existing in traditional border protection solutions by integrating multiple intelligent technologies, and provides a strong guarantee for the security and management efficiency of the network border.

[0069] Glossary:

[0070] Network element: a device or unit responsible for basic network functions;

[0071] Security network element: a function or unit that focuses on network security related services;

[0072] Virtual network element: a network unit implemented in a virtualized environment, which is flexible and scalable;

[0073] Security Stack: usually refers to the collection of all security components and technologies involved in the network architecture, from the lowest infrastructure layer to the highest application layer;

[0074] VNF: Virtual Network Function (virtual network function);

[0075] PNF: Physical Network Function;

[0076] SDN: Software Defined Network;

[0077] SDS: Software Defined Security;

[0078] SC: Service Chain, SC (service chain);

[0079] IaC: Infrastructure as Code (Infrastructure as Code);

[0080] SFC: Service Function Chaining;

[0081] FW: firewall;

[0082] IPS: Intrusion Prevention System;

[0083] WAF: Web Application Firewall;

[0084] AV: Antivirus, antivirus software.

[0085] 1. Methods for ensuring link connectivity in all scenarios

[0086] The full-scenario link protection method provides full-scenario link protection functions through multiple intelligent link protection methods. This method provides complete comprehensive link protection capabilities for various abnormal situations through multiple bypass mechanisms, including: hardware bypass, software bypass, service chain bypass and security network element bypass, ensuring that customer services are adequately protected while ensuring normal services.

[0087] The path of business traffic in the network boundary security stack system is divided into four layers: physical hardware layer, system platform layer, sfc service chain layer and security network element layer, corresponding to the boundary access layer, security resource layer, core switching layer and operation and maintenance management layer, wherein after passing through the network boundary security stack of the present invention, multiple security network elements are formed in the operation and maintenance management layer. There is a corresponding bypass technology at each layer to deal with abnormal situations that may occur at each layer, as well as abnormal situations that the overall device may encounter.

[0088] When hardware, system platform, SFC service chain, security network element and other modules fail, Bypass can ensure that service traffic is forwarded normally to ensure that the security network element failure does not affect the service of the entire machine, and the failure of the entire machine does not affect the network quality.

[0089] The normal scenario business traffic forwarding process is as follows Figure 2 As shown:

[0090] Under normal circumstances, the traffic will pass through the physical hardware layer and the system platform layer in turn to reach the SFC service chain layer; the traffic flowing through the service chain will pass through security network element 1, security network element 2 and security network element 3 in turn, and then flow out through the system platform layer and the physical hardware layer.

[0091] The service traffic forwarding process in the hardware bypass scenario is as follows: Figure 3 As shown:

[0092] When the hardware device is powered off or restarted, the hardware bypass technology will ensure the normal forwarding of business traffic, ensuring that the device does not affect the business of the entire machine. System abnormalities will trigger the device to restart, bypassing the hardware layer to ensure the normal forwarding of business traffic. Usually, a direct line is set between the input and output of the device. If the device is powered off or restarted, the business traffic will be forwarded directly from the input end to the output end, thereby bypassing the hardware layer.

[0093] The service traffic forwarding process in the software bypass scenario is as follows: Figure 4 As shown:

[0094] When an abnormality occurs in the system platform layer, that is, the software layer, such as when the device is upgraded, the traffic will no longer be forwarded to the system platform layer, that is, the traffic will bypass this layer.

[0095] like Figure 4 As shown in the figure, under normal circumstances, the traffic flowing through the service chain passes through security network element 1, security network element 2, and security network element 3 in sequence; if the system platform layer is undergoing equipment upgrades, the system platform layer will be bypassed, and the traffic will be forwarded directly through the physical hardware layer, and will no longer flow through the system platform layer and its upper layers. This ensures the normal forwarding of business traffic and ensures that the failure of the network element at the system platform layer does not affect the business of the entire machine.

[0096] The service chain bypass scenario service traffic forwarding process is as follows Figure 5 As shown:

[0097] If the service chain does not have any security NEs or does not have security NEs in normal state, the traffic will bypass the entire service chain and be forwarded directly through the system platform layer to ensure the normal forwarding of business traffic and ensure that the business of the entire machine is not affected.

[0098] like Figure 5 As shown in the figure, under normal circumstances, the traffic flowing through the service chain passes through security network element 1, security network element 2, and security network element 3 in sequence; after detecting that security network element 1, security network element 2, and security network element 3 are all abnormal, the service chain will be bypassed and the traffic will be forwarded directly through the system platform layer. This ensures the normal forwarding of business traffic and ensures that the failure of the security network element does not affect the business of the entire machine.

[0099] The service traffic forwarding process in the security NE bypass scenario is as follows: Figure 6 As shown:

[0100] When a security network element fails, traffic will bypass the abnormal security network element when flowing through various security network elements on the service chain and flow normally through other security network elements on the chain.

[0101] like Figure 6 As shown, under normal circumstances, the traffic flowing through the service chain passes through security network element 1, security network element 2 and security network element 3 in sequence; after detecting an abnormality in security network element 1, the service chain traffic will pass through security network element 2 and security network element 3 in sequence to ensure the normal forwarding of business traffic and ensure that the failure of the security network element does not affect the business of the entire machine.

[0102] 2. Unified management method for intelligent security capabilities

[0103] In actual usage scenarios, multiple categories of security capabilities are needed to meet comprehensive security protection needs. In order to avoid the risks brought by a single manufacturer, heterogeneity of the same category is also an important security requirement. At the same time, in order to meet the scalability of security capabilities, each security capability is composed of multiple security network elements to provide security services in a unified manner. There will be a large number of security network elements, and individual configuration management will be very complicated, which will seriously affect the complexity of actual operation and maintenance management and greatly increase the difficulty of multi-level management personnel. Therefore, an intelligent, automated, and intelligent security capability unified management method is needed to greatly reduce the complexity and difficulty of operation and maintenance, including: unified network element configuration management method and network element configuration differentiated redundancy management method.

[0104] The Security Stack includes various security mechanisms, tools and services designed to protect information systems from various threats. Elements in the Security Stack may include, but are not limited to, firewalls, intrusion detection / prevention systems (IDS / IPS), antivirus software, encryption solutions, identity authentication and access control systems, etc. The NE unified configuration management module is the functional component responsible for managing and configuring all security devices (i.e., security NEs) in the Security Stack. The goal of the NE unified configuration management module is to uniformly configure and manage security NEs through standardized interfaces, thereby simplifying operations, improving efficiency, and ensuring consistency.

[0105] Specifically, the unified configuration management module of network elements can be regarded as an important part of the security stack. It undertakes the following key responsibilities:

[0106] 1. Configuration management: Configure security network elements, including setting, updating and maintaining security policies.

[0107] 2. Version control: Manage the software version upgrades of security network elements to ensure that all devices run the latest security patches and signature libraries.

[0108] 3. Health monitoring: Monitor the operating status of security network elements to promptly detect and handle potential security issues.

[0109] 4. Fault recovery: Provides fault detection and recovery functions to ensure that problems can be quickly located and repaired when they occur.

[0110] 5. Compliance check: Ensure that all security network elements comply with established security policies and regulatory requirements.

[0111] Through this module, administrators can more conveniently centrally manage various security network elements in the security stack without having to log in to each device separately to operate. This not only improves work efficiency, but also reduces the risk of security vulnerabilities caused by manual configuration errors.

[0112] Therefore, it can be said that the network element unified configuration management module is a core management component in the security stack. It realizes the effective management and control of security network elements through standardized interface specifications, thereby improving the stability and security of the entire security architecture.

[0113] 2.1 Network element unified configuration management method:

[0114] To this end, the core functions of each security network element can be abstracted and the important common parameters can be extracted. At the same time, the common parameters must also meet the configuration logic of each manufacturer. Through this method, the interface specification of each security capability is formulated, and the corresponding configuration management function based on each type of security network element is developed based on the interface specification. It is executed by the unified configuration management module of the network element in the security stack. This type of management function is divided into security capability configuration function and security network element upgrade management function. The former provides security capability management, and the latter manages the network element itself, such as version upgrade, patch package upgrade, feature library upgrade, etc.

[0115] in,

[0116] Common parameters include:

[0117] Interface Type - Network interface standards supported by the device.

[0118] Security policies - including but not limited to ACL rules, signature libraries, certificate management, etc.

[0119] Logging - Supports logging and auditing of events.

[0120] Upgrade management - version update, patch package installation, feature library update, etc.

[0121] Authentication Mechanisms - supported authentication methods.

[0122] Performance indicators - processing speed, maximum number of concurrent connections, etc.

[0123] The interface specifications include:

[0124] In order to specify the core functions of each security network element and the common parameters between them, and formulate interface specifications based on them, the following aspects need to be considered to design the main interfaces:

[0125] 1. Authentication API

[0126] -Function: Used to verify the identity of users or systems.

[0127] -Parameters: username, password, token or other authentication credentials.

[0128] -Examples: OAuth2, JWT (JSON Web Tokens), etc.

[0129] 2. Configuration Management API

[0130] -Function: Allows adding, deleting or modifying configuration items on security devices.

[0131] -Parameters: configuration files, configuration items, validity dates, etc.

[0132] -Example: configure firewall rules, update IPS rule base.

[0133] 3. Logging and Reporting API

[0134] -Function: Collect security event logs and generate reports.

[0135] - Parameters: log level, log message, report format, etc.

[0136] - Example: Send logs to a centralized log server via Syslog.

[0137] 4. Monitoring and Alerting API

[0138] -Function: Monitor the status of safety equipment and issue warnings when abnormalities occur.

[0139] -Parameters: threshold settings, alarm conditions, notification methods, etc.

[0140] - Example: Set an alarm to be triggered when the CPU usage exceeds 80%.

[0141] 5. Software Update API

[0142] - Function: Manage firmware or software updates.

[0143] -Parameters: update package URL, version number, checksum, etc.

[0144] - Example: Automatically download and install the latest version of the IPS signature library.

[0145] 6. Health Check API

[0146] -Function: Regularly check the operating status of the equipment.

[0147] -Parameters: inspection frequency, inspection items, return status code, etc.

[0148] - Example: Ping a device periodically to ensure connectivity.

[0149] 7. Policy Management API

[0150] -Functionality: Create, edit and delete security policies.

[0151] -Parameters: policy name, policy rule set, effective time, etc.

[0152] - Example: Adding a new firewall rule via API call.

[0153] 8. Remote Management API

[0154] - Functionality: Allows remote access and management of devices.

[0155] -Parameters: remote management port, encryption method, session management, etc.

[0156] - Example: Use of SSH or Telnet protocol.

[0157] Through these interface specifications, the unified configuration management module of network elements can achieve consistent management of different security devices, improve management efficiency, and reduce the complexity caused by differences between devices. At the same time, these interfaces need to follow open standard protocols, such as RESTful API, to facilitate integration with other systems and services.

[0158] like Figure 7 As shown in the figure, by analyzing the product startup process of each category and manufacturer, the device startup is divided into several stages: startup stage, system ready stage, and configuration ready stage. The unified configuration management module of network elements has different interactions with security network elements at different stages, and the tasks that security network elements need to do at different stages are also different. For example, only in the final configuration ready stage can traffic be directed to the security network element for security protection. If traffic is directed in advance, it may cause traffic interruption or fail to provide security protection services. After the security network element is started, the unified configuration management module of network elements will start to detect the API interface of the security network element. When the security network element enters the system ready stage, it will return a ready message to the unified configuration management module of network elements. At this time, the unified configuration management module of network elements will identify the category of security network elements, security manufacturers and other information, and decide to use the corresponding API interface to send the corresponding configuration to the security network element. After all configurations are sent successfully, the security network element enters the configuration ready stage. At this point, the unified configuration management module of network elements notifies the traffic diversion module to start diverting traffic to the security network element for security protection according to the corresponding service chain and diversion strategy.

[0159] 2.2 Differentiated redundancy management method for network element configuration:

[0160] The network element configuration differentiated redundancy management process refers to a set of management mechanisms designed to ensure high availability and fault tolerance of the system in a distributed or multi-node environment. This mechanism usually uses multiple components or services with the same functions to ensure that if one component fails, other components can seamlessly take over its workload. The following are some key components of the network element configuration differentiated redundancy management process and their introduction:

[0161] 1. Redundancy Configuration

[0162] -Describes how to deploy multiple secure network elements or modules with the same functionality to ensure that when one of them fails, other instances can continue to provide services.

[0163] -Parameters involved may include redundancy level, failover strategy, etc.

[0164] 2. Health Monitoring

[0165] - Monitor the health status of each network element in real time and detect any problems that may cause service interruption.

[0166] -Key parameters include heartbeat interval, fault detection time, etc.

[0167] 3. Fault Detection

[0168] -Automatically discover and report single points of failure, including hardware failures, software errors, or configuration issues.

[0169] -Parameters may include error code, failure type, recovery suggestions, etc.

[0170] 4. Failover

[0171] - Automatically redirect traffic to the backup system when the primary system detects a failure.

[0172] -Parameters may include switching trigger conditions, switching time window, post-switching verification, etc.

[0173] 5. Load Balancing

[0174] -Distribute the workload across multiple redundant components, ensuring that no single component is overloaded.

[0175] -Parameters may include load algorithms, weight distribution, healthy node selection, etc.

[0176] 6. Recovery Management

[0177] -After a failure, provide automatic or manual recovery mechanisms to help the affected components resume normal operation.

[0178] -Parameters may include recovery priority, recovery steps, recovery verification, etc.

[0179] 7. Data Synchronization

[0180] - Ensure data consistency across all redundant components, especially in stateful services.

[0181] -Parameters may include synchronization frequency, synchronization method, consistency assurance measures, etc.

[0182] like Figure 8 As shown in the figure, the key steps of the alienation redundancy management process

[0183] 1. Define redundancy strategy: Determine which security network elements require redundant configuration and the level of redundancy.

[0184] 2. Implement health monitoring: Deploy tools or services to continuously monitor the health of each network element.

[0185] 3. Set up a fault detection mechanism: clarify the specific methods and trigger conditions for fault detection.

[0186] 4. Configure a failover plan: Design how the backup node can quickly take over the service when the primary node fails.

[0187] 5. Load balancing strategy: formulate load balancing rules to distribute requests to each network element in the best way.

[0188] 6. Establish a recovery plan: Prepare a detailed recovery process to resume normal operations as soon as possible after the failure is resolved.

[0189] 7. Data consistency assurance: Take measures to ensure data synchronization and consistency between all redundant components.

[0190] Through such an alienated redundant management process, the reliability and stability of the entire system can be significantly improved, the risk of single point failure can be reduced, and the overall service quality can be improved.

[0191] 3. Optimization Methods Based on Software-Defined Orchestration Technology

[0192] The optimization method based on software-defined orchestration technology is an innovative optimization method to improve the overall security capability processing performance of security orchestration equipment in the business network. The optimization method based on software-defined orchestration technology simplifies the design of traffic paths between multiple security network elements and improves the efficiency of information transmission. Compared with traditional orchestration technology, it has the characteristics of less resource occupation and higher transmission performance in terms of transmission efficiency.

[0193] like Fig. 9 The figure shows the complete data packet processing flow of the security capability orchestration device in the service network. In this processing flow, the security orchestration device in the core switching area receives the packet, processes it based on its own orchestration capabilities, matches it to the service chain, and forwards the data packet to each security network element on the service chain in sequence according to its own design. After all security network elements have completed processing, the security orchestration device sends a signal to mark the end of the processing flow.

[0194] With the increasing traffic in the network service network, it is crucial to improve the overall transmission and processing performance of the equipment to prevent the security orchestration equipment from becoming a performance bottleneck in the link. Fig. 9 In the analysis, the factors that affect the overall processing performance in the orchestration network are composed of the following: packet size, data path length, security network element performance, physical hardware performance, etc.

[0195] When the network element processing power and physical hardware are the same, the optimization method based on software-defined orchestration technology is mainly to optimize the data packet size and data path length.

[0196] The software-defined orchestration technology approach has the following advantages: flexible external networking access methods; flexible internal VNF access methods, including inline, three-layer, and bypass modes; support for fine-grained policy-based traffic orchestration; support for load balancing and detection; and high-performance traffic processing capabilities.

[0197] 3.1 Optimization of data encapsulation technology:

[0198] The standard service chain is defined in RFC7665, but the RFC only defines the general idea, not the detailed implementation method, so it leaves room for each manufacturer to implement its own private method. The basic method is to create a logical tunnel for data and pass the data to each SFC forwarding node on the service chain. Each SFC forwarding node is actually independent of each other and does not have global SFC information. In this way, it is necessary to encapsulate the network service header (Network Service Header, NSH, defined in RFC8300) in the data header to find the next destination node of the data. This encapsulation and decapsulation operation will reduce the processing power of the device; at the same time, when the number of service chain nodes is large, the number of encapsulation layers will increase accordingly, which may cause the data packet length to exceed the MTU of the interface, which will bring a series of fragmentation-related problems. For example Fig.10 shown.

[0199] Since the relatively new protocol NSH needs to be used, each node device on the SFC path also needs to support the NSH protocol to ensure data flow, which places high requirements on the network capabilities of all node devices. In addition, the path for reverse traffic also needs to be defined to ensure that it passes through each node in reverse order. The configuration is relatively difficult. Once the SFC is modified, the configuration on the relevant nodes must be modified accordingly.

[0200] The service chain based on software-defined orchestration technology distributes traffic through a centrally managed distribution platform. SFC is defined on the distribution platform, which can include various VNFs and PNFs. Dynamic forwarding flow tables are stored on the corresponding resource servers for the rapid distribution of intermediate traffic. For data that needs to go through SFC, the distribution platform directly forwards the original data packet to the corresponding SFC node device. Since the data is not modified, no special protocol processing is required on the node device, so it has wide adaptability.

[0201] In a certain case, for remote resource nodes, the traffic distribution platform will send SFC-related dynamic RFC information to the relevant resource nodes, and the resource nodes will directly forward data between network elements based on the RFC information.

[0202] This design not only reduces the requirements for network elements, as long as they can process common protocol data, but also ensures processing speed. The data packets processed by each node in the SFC are original data, without the need for encapsulation and decapsulation operations. The node equipment only needs to support the Layer 2 transparent mode, which improves the orchestration processing performance within the service chain. Fig.11 , 12 shown.

[0203] 3.2 Optimization of network element allocation method

[0204] Based on the optimization of the network element allocation and scheduling algorithm, different security network elements on the service chain can be allocated to the same resource node as much as possible, thereby effectively reducing the data transmission loss across physical devices between network elements in the service chain. From the perspective of the data transmission path, the length of the physical network data link path and the length of the virtual network data link path are reduced.

[0205] The scheduling of security network elements to the resource boards in the resource nodes adopts a resource board round-robin scheduling algorithm.

[0206] The round-robin scheduling algorithm based on the resource board is as follows:

[0207] The defined SFC service chain is FW->IPS->Waf->AV. FW is usually a firewall, IPS is an intrusion prevention system, Waf is a web application firewall, and AV is antivirus software.

[0208] In the prior art, each network element group randomly selects a network element from its own group to forward traffic in the SFC based on load balancing, such as Fig.13 As shown, the traffic of an SFC forwarding chain needs to pass through different resource boards. If you want to optimize the forwarding performance of the SFC service chain, you need to give priority to allowing the forwarding of network elements in the same SFC service chain to be completed locally, reducing the forwarding of the same service chain across resource boards.

[0209] The optimized resource board order priority scheduling strategy is as follows: Fig.14 As shown:

[0210] The same security network element group will be sent to all resource nodes. Since the security network element group ID is the same but the security network element ID is different in the same security network element group, a security network element is created in each security network element group and a priority scheduling strategy is implemented based on the security network element ID. Fig.15 shown.

[0211] like Fig.15 As shown, the method comprises the following steps:

[0212] S31, Web sends a network element creation request;

[0213] S32, the configuration management module allocates a network element ID to the network element; if the allocation is successful, execute S33, if the allocation fails, execute S37;

[0214] S33, perform network element scheduling; obtain the resource board node by taking the remainder of the network element ID and the number of resource boards;

[0215] S34, determine whether the free resources of the resource board are sufficient, if yes, execute S36; otherwise, execute S35;

[0216] S35, select a resource board node from the remaining resource board nodes based on Robin, and execute S36 after finding a resource node that meets the specification conditions;

[0217] S36, executing resource scheduling response processing;

[0218] S37. Determine whether the scheduling is successful. If not, the creation of the network element fails. If yes, continue to execute the remaining process of creating the network element.

[0219] After the scheduling algorithm, ensure that network elements with the same security network element ID between different network element groups are preferentially scheduled on the same resource board to meet the local priority strategy of network element forwarding in the same SFC service chain. Based on the above scheduling algorithm, under the condition that the resource board has sufficient resources, network elements with the same security network element ID are preferentially ensured to run on the same resource board. Fig.16 As shown:

[0220] like Fig.16 As shown in the figure, after the optimized scheduling algorithm, the network elements of the same color have the same network element ID and are distributed on the same resource board. There are two service chains in the figure: SFC1: FW->IPS->WAF->AV; SFC2: IPS->WAF->AV.

[0221] 3.3 Service Chain Scheduling Optimization

[0222] The security stack is a refined traffic orchestration for user business traffic, that is, for traffic that hits the service chain strategy, it needs to be dispatched to different virtual security network elements for processing according to the logical order pre-defined by the user. Therefore, the service chain scheduling capability of the diversion platform is crucial to realize the function of the service chain.

[0223] In traditional chassis equipment, one resource board can only correspond to one network element, such as a firewall resource board, intrusion defense resource board, etc., which results in more resources being consumed in service chain network element scheduling. The service chain scheduling optimization based on soft definition can enable one resource board to carry multiple network elements with different security capabilities, support flexible scheduling, and improve resource scheduling performance.

[0224] The hardware logic architecture of the security stack is as follows: Fig.17 As shown:

[0225] The main control board M1 plays the role of the diversion platform (two main control boards M1 / M2 are deployed in active and standby mode, only M1 is discussed here), the resource boards R1 / R2 / … / Rn play the role of resource nodes (only R1 / R2 is discussed here), and the switch boards S1 / S2 play the role of traffic load balancing (only S1 is discussed here).

[0226] The traffic diversion platform M1 is the management entrance of the entire security stack, where users configure security policies and service chain policies. When users add new virtual network elements, the management plane of the traffic diversion platform will refer to the resource occupancy of each resource node to select the appropriate resource node for deployment. For example, in the figure above, virtual network elements V1 / V2 are deployed on resource node R1, and virtual network elements V3 / V4 are deployed on resource node R2. When selecting resource nodes, for virtual network elements belonging to the same service chain, the same resource nodes will be allocated as much as possible, thereby reducing the scheduling overhead between virtual network elements.

[0227] As a distributed system composed of multiple hardware boards, the traffic distribution platform M1 has a global perspective, knows the distribution of all traffic, and the complete definition of the service chain strategy, and pushes the forwarding flow table to the resource node based on the matching of the strategy;

[0228] Resource nodes R1 / R2 are only executors of the forwarding strategy and rely on the forwarding flow table to forward packets to the virtual network element.

[0229] Switch board S1 is responsible for load balancing the incoming traffic to prevent a single resource node from becoming a performance bottleneck. The hash algorithm of the switch board is usually L3 hash or L4 hash, so that the packets of each flow will be assigned to the same resource node (R1 or R2) for processing.

[0230] 1) Network elements are on the same resource node

[0231] Based on the software-defined service chain scheduling method, when the first message Pkt1 of a flow (denoted as Flow1) arrives at the system, the switch board S1 will load balance it to the resource board R1. Since R1's flow table is empty and it does not know how to process this message, it redirects it to the distribution platform M1 for processing.

[0232] This process can be expressed as: Pkt1: S1->R1(rule miss)->M1. Fig.18 shown.

[0233] M1 receives the packet Pkt1 of flow Flow1 and performs the standard L2 / L3 forwarding process. In the process of matching the service chain policy, it is found that the packet hits the service chain Chain 1: V1->V2, that is, it needs to pass through two virtual network elements V1 and V2, and these two network elements are on R1. So M1 will send the following forwarding flow table to R1:

[0234] Rule1: Flow1: V1->V2->Port1; (Port1 is the outbound interface for L2 / L3 forwarding)

[0235] The meaning of the rules is:

[0236] a. Schedule the message hitting F1 to virtual network element V1 for processing;

[0237] b. The traffic processed by virtual network element V1 is dispatched to virtual network element V2.

[0238] c. After the traffic is processed by virtual network element V2, the service chain scheduling process is completed, and the forwarding process is also completed, and it can be sent directly from Port 1;

[0239] M1 sends Rule1 to R1. This process can be expressed as: Pkt1: M1 (pushrule1) -> R1. Fig.19 shown.

[0240] Then, M1 dispatches the message back to R1 for processing and executes the forwarding action of V1->V2->Port1: first, the message is sent to V1, and after V1 processes it, it is sent to V2, and after V2 processes it, it is forwarded from Port1. This process is recorded as: Pkt1: R1(rule1hit)->V1->V2->Port1; Fig. 20 shown.

[0241] When the subsequent message Pkt2 / Pkt3 / Pktn of Flow1 arrives, firstly, S1 ensures that the message will be hashed to the same resource board R1. Secondly, R1 already contains the forwarding information of Flow1, so it can process the forwarding of Flow1 normally without the direct participation of M1. This process is recorded as: Pkt2 / Pkt3: S1->R1(rule1 hit)->V1->V2->Port1. Fig.21 shown.

[0242] The advantages of software-defined service chain scheduling ensure that network elements belonging to the same service chain are distributed on the same resource nodes. The scheduling between network elements can be completed within the resource nodes without the need for processing by the diversion platform M1, which greatly reduces the pressure on the diversion platform M1 and avoids the waste of the internal bandwidth of the frame.

[0243] 2) Security network elements at different resource nodes

[0244] For the case where the service chain spans multiple resource nodes, such as Chain2: V1->V2->V3->V4, the virtual network elements are distributed on the two resource nodes R1 and R2 (of course, the management plane will try to ensure that V1 / V2 / V3 / V4 are deployed together). After V2 on R1 is processed, there are two options:

[0245] a. In the prior art, the next node V3 is not on the current resource node R1. R1 does not know the distribution of non-local network elements and needs to dispatch the message back to the distribution platform M1, which is then dispatched to R2 via M1; ...->V2->R1->M1->R2->V3->..., such as Fig. 22 shown.

[0246] b. The optimized service chain resource scheduling method: when M1 sends the flow table to R1, it knows that the next network element of V2 is on the non-local resource node R2, and can reflect this information in the forwarding table, such as Rule2: Flow2: V1->V2->R1->R2. Here, R1 does not need to know how R2 schedules the rest of the service chain; ...->V2->R1->R2–>V3->…. Fig.23 shown.

[0247] The optimized service chain resource scheduling method can save another message scheduling. Fig.24 shown.

[0248] 3.4 Real network function verification

[0249] The real network verification scheme in the prior art is as follows:

[0250] 1) All messages are dispatched to the distribution platform M1 (that is, the resource board does not participate in load balancing);

[0251] 2) The traffic distribution node matches the service chain strategy Chain1: V1->V2. The first network element is on R1 and is dispatched to R1 for processing;

[0252] 3) R1 receives the message, processes it through V1, and then dispatches it back to M1;

[0253] 4) M1 receives the message and continues to process the second network element, which is still on R1, and continues to dispatch it to R1 for processing;

[0254] 5) R1 receives the message, processes it through V2, and then dispatches it back to M1;

[0255] 6) M1 receives the message, Chain1 ends, L2 / L3 forwards it, and selects Port1 as the egress to send it out;

[0256] 7) Repeat steps 1) to 6) for subsequent messages.

[0257] In this solution, M1 can easily become the performance bottleneck of the system, and the same message needs to be scheduled back and forth multiple times within the system. The longer the service chain is, the greater the additional scheduling overhead is, and the more serious the waste of hardware bandwidth is, which seriously affects the performance of the entire machine. Comparison of resource scheduling methods before and after solution design optimization:

[0258] Table 1 Comparison of service chain scheduling before and after optimization

[0259]

[0260]

[0261] 4. Unified scheduling method based on virtual network elements and physical devices

[0262] The unified scheduling method based on virtual network elements and physical devices is an innovative method proposed mainly to solve the problem that virtual network elements and physical devices cannot be uniformly scheduled. Compared with the current situation that traditional orchestration technology can only orchestrate virtual network elements or physical devices separately, this method can abstract both virtual network elements and physical devices into a new security service object, allowing users to ignore the two device forms and only focus on their security protection capabilities. The service chain is used for flexible combination, which greatly reduces the complexity of operation and maintenance, and can also reuse old equipment and solve the problem that some equipment does not have a virtualized form.

[0263] like Fig.25 As shown in the figure, virtual network elements are to be connected to the corresponding virtual network when they are created, and then orchestrated and used, while physical devices are to be wired in the physical network and are not related to the virtual network. If you want to orchestrate the physical devices in the physical network and the virtual network elements in the virtual network at the same time to form a mixed virtual and real service chain, you need to reclassify and define the network, analyze the use of virtual network elements and physical devices, define the characteristics of physical network elements, and then combine the service chain to conduct compatibility analysis and design.

[0264] 4.1 Definition of Physical Network Elements

[0265] In order to design and define physical network elements, it is necessary to first sort out the main deployment and use methods of physical security devices in the network. In the business network, physical security devices are mainly divided into two-layer access and three-layer access. For the service chain of three-layer access, the devices are generally connected together based on routing, and the traffic is transmitted to the physical security device through policy routing. This access method requires the corresponding three-layer network and IP of the physical security device to logically string the physical security device into a service chain. This method is complex and inflexible to use. If you want to adjust the composition of the service chain during the process, it is even more difficult to do so, so three-layer access is basically not considered. Two-layer access is more flexible and convenient, and is divided into serial access and bypass access. Different physical security devices may use different access methods. Combined with the unified use of compatible virtual network elements, the situation of software-defined networks is sorted out.

[0266] like Fig.26 , defines the network into four categories: internal management network, business network, service chain series network, service chain bypass (mirror) network. Interfaces are also divided into four categories: internal management interface, business network interface, series interface (a pair), bypass (mirror) interface.

[0267] The network is divided into four categories based on different demand scenarios.

[0268] Internal management network: The internal management network is an internal management network that is not externally perceived and is used to manage VNFs, including password-free jumps, VNF configuration initialization (network), and centralized management. This network is required for virtual network elements, but not for physical network elements.

[0269] Business network: Business network is the network business network connected to the user, mainly used for proactive security services based on the three-layer network. For example, the vulnerability scanning system connects to the customer's business network through this network for scanning. This network is mandatory for virtual network elements, but not for physical network elements, and multiple networks can exist. Each business network will have an interface connected to it in the VNF.

[0270] Service chain serial network: The service chain serial network is used to arrange network elements and form a logical serial network. The reason why the service chain does not need routing for serial connection is that multiple VNFs are serially connected through the second-layer access method. It does not need to achieve the effect of a single service chain by configuring multiple three-layer networks and combining policy routing like other service chains. This network is selected according to the use of network elements. Network elements that need security protection on the serial chain need to be configured.

[0271] Service chain bypass network: The service chain bypass network is specifically used for traffic mirroring, which is used to copy the specified traffic and distribute it to the bypass audit, analysis, and statistics network elements in the side chain of the service chain. This network is also selected according to the use of the network element. The network elements that need to perform statistical analysis on the bypass chain need to be configured.

[0272] According to the above four types of network definitions, there are also four corresponding types of interfaces.

[0273] Internal management interface: The internal management network is mandatory for virtual network elements, so there must be an internal management interface in the VNF. The default is the first interface, DHCP mode, and it will automatically obtain an internal network IP after startup. This IP will be used for password-free jumps and RESTAPI configuration, etc., but physical network elements do not need it. The internal management interface is Fig.26 The e0 interface in the network element.

[0274] Service network interface: Since service network is mandatory for virtual network elements and there is at least one, there will be one interface for each service network in the VNF. Service-oriented VNFs will provide relevant security protection through this network, such as vulnerability scanning, SSLVPN, etc., which is also not required for physical network elements. The service network interface is Fig.26 The e1 interface in the VNF in .

[0275] Serial interface: If you want to orchestrate the network element into the serial chain of the service chain, you need to select the serial network when creating or defining the network element. There will be a pair of interfaces in the virtual network element, and the physical network element needs to select a pair of interfaces on the physical device as the serial interface. This pair of interfaces is required to be included in the bridge for Layer 2 transmission, one interface in and one interface out. The service chain orchestration engine will send the specified traffic to the serial interface of the corresponding network element in sequence according to the diversion strategy and service chain strategy. The traffic received from the serial interface will find the next network element according to the service chain strategy and repeat the above actions until the last network element in the serial chain of the service chain has processed the traffic and then forwarded it. The serial interface is Fig.26 The e2 and e3 interfaces in the VNF. e2 is the serial input interface, and e3 is the serial output interface.

[0276] Bypass interface: If you want to orchestrate the VNF into the bypass chain of the service chain, you need to select the bypass network when creating or defining the network element. There will be an additional corresponding interface in the VNF, and the physical network element needs to select an interface on the physical device as the bypass interface. The interface needs to be set to bypass mode to receive and process the mirrored traffic. The service chain orchestration engine will copy the specified traffic according to the diversion strategy and service chain strategy, and send it to the bypass interface of each network element in the bypass chain. The bypass interface is Fig.26 The e4 interface in the VNF in Figure 1.

[0277] According to the above definition and analysis, there are significant differences between physical network elements and virtual network elements. Physical network elements only care about the networks and interfaces of serial or bypass services. Physical devices do not require any customized development and can be directly managed by the service chain, thereby better achieving the effect of reusing old devices.

[0278] 4.2 Unified Service Chain Orchestration Method

[0279] Based on the differences between virtual network elements and physical network elements, it is necessary to abstract the two objects, extract the attributes of the intersection of the two objects, and form a new common network element object. For the service chain function, it is necessary to change to orchestrate this new network element object, no longer use the previous virtual network element object and physical network element object, no longer distinguish whether the orchestration is virtual network element or physical network element, and when distributing traffic, only care about the series connection or bypass interface of the network element object, so as to achieve compatibility.

[0280] like Fig. 27 In addition to some of its own characteristics, virtual network elements also include network-related attributes. Network-related attributes include internal management networks, business networks, series networks, bypass networks, and corresponding network interface information.

[0281] like Fig.28The attributes of physical network elements are fewer than those of virtual network elements. In addition to their own characteristics, they also include network-related attributes. The network-related attributes only include the series network, bypass network, and corresponding interface information of the corresponding network.

[0282] like Fig.29 , virtual network element objects and physical network element objects are finally converted into new network element objects, which extract the attributes of the intersection part and refine the four types of networks and the corresponding four types of interfaces to form independent interface objects. After the service chain references the new network element object, the compatibility of virtual and physical network elements has been completed. In subsequent use, there is no need to consider the relevant differences. You only need to define the required virtual network elements and physical network elements, and directly reference them in the service chain to form a virtual-real hybrid service chain to achieve the corresponding security protection effect, simple operation and high flexibility.

[0283] 5. Infrastructure as Code Implementation Method for Security Resource Pool

[0284] The present invention utilizes the infrastructure as code module, and the security resource pool can save the configuration files of all network elements it contains and the topological connection relationships between network elements in the form of text to the version control system to form an infrastructure configuration library of the security resource pool.

[0285] The present invention discloses a method for implementing infrastructure as code of a security resource pool, which includes two processes:

[0286] S51, obtaining the infrastructure configuration of the security resource pool and saving it to the version control system;

[0287] S52. Load the configuration of the security resource pool from the version control system and deploy it to the security resource pool.

[0288] 5.1. The process of obtaining the infrastructure configuration of the security resource pool and saving it to the version control system is as follows (the flowchart is as follows Fig.30 shown):

[0289] Step S511, configure in the security resource pool interface;

[0290] Step S512: The configuration management module sends configurations to network elements in the security resource pool;

[0291] Step S513: The configuration management module saves the configuration;

[0292] The security resource pool includes: network elements, configuration management modules, infrastructure as code modules, and version control systems;

[0293] The configuration management module is used to read the configuration of the network elements in the security resource pool, and is also used to send the configuration to the network elements and save the configuration;

[0294] The infrastructure as code module is used to describe the infrastructure as code text and perform network element configuration and topology relationship saving and rollback;

[0295] The version control system is used to save the historical configuration of network elements. The security resource pool can save the configuration files of all network elements it contains and the topological connection relationships between network elements in the version control system in text form.

[0296] Step S514: The infrastructure as code module obtains the network element configuration file whose configuration has been changed, and the topology connection relationship configuration;

[0297] Step S515: The infrastructure as code module saves the complete configuration file and topology connection relationship configuration after the network element is changed to the version control system.

[0298] Furthermore, the security resource pool also includes a code comparison tool for comparing the security resource pool configurations at different time points to see what changes have occurred.

[0299] 5.2. The process of loading the configuration of the security resource pool from the version control system and deploying it to the security resource pool is as follows (the flowchart is as follows Fig.31 shown):

[0300] Step S521: Select the time point to which you want to roll back the configuration in the security resource pool interface, and perform the rollback operation;

[0301] Further, a specific network element is selected to perform rollback;

[0302] Further, the entire security resource pool is selected for rollback.

[0303] Furthermore, after a failure occurs in the security resource pool, a time point before the failure is selected for rollback.

[0304] Step S522: The infrastructure as code module pulls the configuration files and topology connection relationship configurations of the network elements on the specified date from the version control system, and sends them to the configuration management module;

[0305] Step S523: The configuration management module sends configurations to network elements in the security resource pool;

[0306] Step S524: The configuration management module saves the configuration.

[0307] After the security resource pool realizes infrastructure as code, the security resource pool will have the ability to perform rollback for specific network elements and the entire security resource pool, thereby supporting the security resource pool to quickly stop losses after a failure occurs. At the same time, the security resource pool can also rely on this capability to conveniently restore the fault site and verify the fault recovery plan in subsequent fault drills.

[0308] A secure resource pool that adopts an infrastructure-as-code approach can achieve the following benefits:

[0309] 1. It helps to roll back the security resource pool to the state before the failure when a failure occurs;

[0310] 2. The security resource pool can be restored to the configuration state at a specified time;

[0311] 3. You can easily use code comparison tools to compare the security resource pool configurations at different time points to see what changes have occurred.

[0312] VI. Automatic orchestration and deployment method of security service chain based on particle swarm algorithm

[0313] The present invention can complete two-way support for automatic orchestration of virtualized security service chains by making programmable preprocessing settings for network traffic in a virtualized environment, adopt particle swarm algorithm model matching to obtain the best security service chain strategy combination, implement and deploy security service chains based on the best match, continuously optimize and adjust, and complete the automatic orchestration process.

[0314] In order to solve the problem of high bandwidth consumption in the automatic orchestration of virtualized security service chain, the optimal solution is obtained by setting constraints, which not only effectively improves the request success rate, but also reduces bandwidth consumption, improves the efficiency of the orchestration algorithm and effective transmission capacity.

[0315] The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The particle swarm algorithm model is used to design the data transmission process, improve the programmability of the service chain, and realize the two-way support of the automatic orchestration of the virtualized security service chain. In view of the high bandwidth consumption problem in the automatic orchestration of the virtualized security service chain, the optimal solution is obtained by preprocessing sample parameters and extracting sample parameter settings, which not only effectively improves the request success rate, but also reduces bandwidth consumption and improves the ability of effective transmission.

[0316] 6.1. Sample parameter preprocessing

[0317] By setting programmable preprocessing for network traffic in a virtualized environment, bidirectional support for automatic orchestration of virtualized security service chains can be achieved. However, multiple constraints need to be considered during the automatic orchestration process, including:

[0318] The number of requests on the security service chain must be less than or equal to the amount of resources that the corresponding physical node can provide;

[0319] The bandwidth request amount also needs to be less than or equal to the bandwidth provided on the virtual link;

[0320] There can be only one mapping between a virtual link and an actual physical path;

[0321] At the same time, in order to reduce the bandwidth consumption during the automatic arrangement of the virtual environment security service chain, the present invention sets the minimized total bandwidth as the optimal solution for the automatic arrangement.

[0322] 6.2. Sample parameter setting and extraction

[0323] To extract the sample parameters, it is first necessary to complete the setting of the characteristic sample parameters. In a certain embodiment, the physical topology of the virtualized environment includes a main core layer switch, and the number of other switches in the aggregation layer and the edge layer are defined as N (5) and M (40), respectively. The specific settings of the sample parameters are shown in Table 2. The total number of requests for the virtualized link is set to Z (500 times). To ensure the authenticity of the sample results, a total of K (20 times) tests are performed under the same parameters. The number of virtual network functions on the security service chain is increased from 1 to 20 according to the number of tests, and the number of requests each time is set to 20.

[0324] Table 2 Test sample parameter settings

[0325]

[0326]

[0327] 6.3. Automatic orchestration and deployment model design

[0328] After obtaining the test sample parameters in the virtualized environment, an automatic orchestration deployment model needs to be established for the security protection design of the virtualized network. According to the security business requirements of the upper-level users and the automatic architecture service chain strategy, the virtual security network element protection function is realized, and the data stream being transmitted is securely dispatched to the virtual security network element to achieve security protection of the transmission sequence.

[0329] The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The specific process is as follows:

[0330] Step S61: Initialize the particle swarm of the automatic orchestration deployment model and randomly generate a group of particles, each particle representing a possible strategy combination, also called an orchestration solution.

[0331] Step S62, calculate fitness: calculate the fitness value of each particle according to the evaluation function (fitness function) of the problem. This value can be the direct output of the fitness function, or it may need to be converted to a certain extent (such as taking the opposite number to adapt to the maximization problem).

[0332] Step S63: Perform fitness evaluation on each particle according to a predetermined fitness function.

[0333] Step S64: Record the position of the particle with the best fitness in the particle swarm, i.e., the global optimal solution. Update the speed and position of each particle by considering the individual historical optimal position and the global optimal position.

[0334] Step S65, repeating steps S62 to S64 until the termination condition is met, and obtaining the position of the particle with the best fitness, which is the optimal solution, corresponding to the best security service chain strategy combination.

[0335] Step S66: deploy and adjust the security service chain according to the best strategy combination represented by the optimal solution, continuously optimize and adjust, and complete the automatic orchestration process.

[0336] Wherein, the fitness function implementation method is:

[0337] In function optimization problems, the fitness function usually directly uses the objective function. For example, in the problem of finding the minimum value, the smaller the objective function value, the higher the fitness of the particle. The present invention designs a binary optimization function and sets the objective function as f(x, y) = x 2 +y 2 , we need to find the minimum value of the function. In this problem, we directly use the objective function as the fitness function, and the function formula is defined as follows:

[0338] Fitness(x,y)=x 2 +y 2

[0339] Where x and y represent two input variables. The present invention comprehensively considers the number of user requests in the security service chain orchestration and the bandwidth consumption in the orchestration process as fitness indicators. Therefore, the input variable of x is defined as the number of user requests, and the input variable of y is defined as bandwidth consumption. The particle swarm algorithm will evaluate the position of each particle according to this fitness function, and guide the particles to move to the area with a smaller fitness value, so as to find the minimum value of the function.

[0340] The automatic orchestration and deployment model of the virtualized environment security service chain can automatically realize the orchestration of service chain strategies and the automatic deployment of virtual security network elements, securely dispatch data flows to the corresponding virtual security network elements for security protection, improve security protection reliability, and reduce management workload. In this process, two key issues need to be completed:

[0341] 1) Solve the policy conflict problem in the automatic orchestration of security service chains in virtualized environments;

[0342] 2) Solve the problem of network traffic scheduling optimization.

[0343] To solve the above two problems, the present invention designs a security service chain automatic orchestration deployment model based on particle swarm algorithm, such as Fig.32 As shown, it also includes: a policy conflict decision node, a network traffic scheduling node and a security resource pool;

[0344] In the case of conflicts in automatic orchestration decisions, the policy conflict decision node first automatically provides network security protection services for business traffic through the open policy scheduling interface. However, due to the influence of different previous and subsequent policies, there is a high probability that there will be some conflicts between the execution actions. At this time, the optimal policy combination obtained based on the particle swarm algorithm is used to automatically coordinate and manage the relationship between various services, so that the policy conflict decision node can correctly orchestrate network flow transmission according to the priority of the security service chain, eliminate conflicts in the environment, reduce network congestion, thereby reducing CPU load and CPU utilization, and at the same time transmit the scheduling optimization decision results to the corresponding network traffic scheduling node.

[0345] The network traffic scheduling node is responsible for analyzing and managing the virtualized security network elements in the security resource pool, effectively realizing the automated monitoring of network element load information, outputting the corresponding security traffic scheduling configuration according to the security service chain orchestration strategy, parsing the security network element type, and evaluating the best policy scheduling solution from the scheduling optimization decision results of the policy conflict decision node. Through the message queue, the actually configured security traffic scheduling information policy is automatically transmitted to the virtualized security network elements in the security resource pool to realize the directional processing of data traffic.

[0346] The message queue uses asynchronous communication. The sender in the security resource pool (inbound traffic, generally refers to the source IP address of the network traffic) sends the message to the queue without waiting for the response from the receiver (outbound traffic, generally refers to the destination IP address of the network traffic). This can improve the response speed of the security service chain.

[0347] 6.4. Sample parameter comparison training

[0348] Based on the extracted sample parameters, the experimental data analysis was conducted on the average total bandwidth consumption of the zero-touch network orchestration method, the real-time seamless orchestration method, and the method used in this project. In the experiment, the same physical topology was input into the virtualized environment, and the same number of security service chain requests were input into the three methods, and the average total bandwidth consumption of the three algorithms was compared. The calculation process of the average total bandwidth consumption is shown in the following formula:

[0349]

[0350] Where D represents the total data volume and T represents the data transmission time. Fig.32 shown.

[0351] according to Fig.33It can be seen that although the calculation process of the zero-contact network orchestration method is relatively simple and can greatly improve the efficiency of the orchestration algorithm, the corresponding average total bandwidth consumption is relatively high, and the consumption is far greater than the real-time seamless orchestration method and the method of this project. The changes of the present invention are more stable than the zero-contact network orchestration method and the real-time seamless orchestration method. In the process of increasing number of user requests for the security service chain of the virtualized environment, the average total bandwidth consumption of the present invention can be stably maintained at a certain level range. This is mainly because in the process of automatic orchestration of the service chain, the present invention sets the minimized total bandwidth as the automatic orchestration goal, which reduces the total average bandwidth consumption in the process of automatic orchestration of the virtual environment security service chain, and ensures that the average total bandwidth consumption can be stably maintained at a certain level range.

[0352] An experimental comparison and analysis of the request success rate under different algorithm conditions was conducted. In the test, the same physical topology structure was input into the virtual link to ensure that the number of security service chain requests of the three methods was the same. The request success rates of the zero-contact network orchestration method, the real-time seamless orchestration method and the present invention were experimentally analyzed and compared. The calculation of the request success rate is shown in the following formula:

[0353]

[0354] Among them, Nc represents the number of successful requests, and N1 represents the total number of requests. The specific experimental results are as follows Fig.34 As shown, according to the experimental results, the user security service chain request success rate corresponding to the zero-contact network orchestration method is much lower than the real-time seamless orchestration method and the present invention. By comparing the zero-contact network orchestration method and the present invention, it can be seen that as the number of cloud network users' requests for the security service chain continues to increase, the request success rate of the present invention can remain stable and is always higher than the zero-contact network orchestration method. This shows that the present invention can effectively improve the user's request success rate to a certain extent while saving bandwidth consumption, and achieve better service chain automatic orchestration. The reason for the analysis is that the service nodes are dynamically scheduled through the security service chain automatic orchestration deployment model based on the particle swarm algorithm, and the real-time feedback results are used to effectively reduce the system failure rate, thereby improving the request success rate.

[0355] 6.5. Real network data test verification

[0356] By extracting about 500Gbps of real data from a telecommunications user for comparative testing and verification, under the premise of using the same physical topology, the particle swarm algorithm-based security service chain automatic orchestration deployment model and the traditional SDN-based traffic scheduling model were compared and tested. The tester recorded the maximum throughput, maximum number of new connections, and maximum number of concurrent connections that can be achieved under the two models, and the test results were compared. Fig.35 , 36 shown.

[0357] Test conclusion: Compared with the traditional SDN-based traffic scheduling technology, the automatic orchestration technology of the security service chain based on the particle swarm algorithm can improve the traffic scheduling and detection performance by up to 65% in a virtualized environment, solving many problems of insufficient performance, complex management, and low efficiency in traditional traffic diversion and service chain orchestration technologies.

[0358] The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The particle swarm algorithm model is used to design the data transmission process, improve the programmability of the service chain, and realize the two-way support of the automatic orchestration of the virtualized security service chain. In view of the high bandwidth consumption problem in the automatic orchestration of the virtualized security service chain, the optimal solution is obtained by setting constraints, which not only effectively improves the request success rate, but also reduces bandwidth consumption and improves the ability of effective transmission.

[0359] The particle swarm algorithm-based security service chain automatic orchestration and deployment technology of the present invention can improve the traffic scheduling and detection performance by up to 65% in a virtualized environment compared to traditional SDN-based traffic scheduling technology, solving many problems of insufficient performance, complex management, and low efficiency in traditional traffic diversion and service chain orchestration technologies.

[0360] In summary, the present invention designs and implements a next-generation network border security stack system, which uses the above-mentioned technology to help optimize network performance, reduce data transmission delays and errors, and thus provide users with a smoother and more secure network experience.

[0361] The network border security stack system of the present invention effectively solves the problems existing in traditional border protection solutions by integrating multiple intelligent technologies, and provides a strong guarantee for the security and management efficiency of the network border.

[0362] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network border security stack system, characterized in that: Based on the concept of integrated security protection, the system adopts a layered, embedded, multi-dimensional integrated security protection design; Layering refers to the use of software-defined architecture to divide the system into: border access layer, security resource layer, core switching layer and operation and maintenance control layer; the border access layer includes the next-generation border protection equipment, and the security resource layer virtualizes the border protection equipment in the border access area into a multi-source heterogeneous network element pool base through network resource virtualization technology, computing resource virtualization technology, and storage resource virtualization technology; the core switching area realizes multi-dimensional and detailed security control of network traffic; the operation and maintenance control layer realizes unified operation and management; Embedding means that through integrated design, the multi-source heterogeneous network element pool base at the security resource layer adopts the network traffic unsupervised anomaly detection method based on the improved Transformer reconstruction model, the encrypted traffic anomaly rapid detection method based on the plaintext traffic characteristics, and the infrastructure as code implementation method of the security resource pool, so as to be embedded and integrated in the business process from the underlying architecture and data transmission level; Multi-dimensional refers to the use of flexible service chain orchestration methods and full-scenario link security methods in the core switching area to achieve multi-dimensional and detailed security control of network traffic, break the constraints of one-dimensional traffic processing, enter the multi-dimensional space of traffic, and achieve high-speed concurrency of different traffic security processing; Among them, the flexible service chain orchestration methods include: orchestration methods for decrypted traffic service chains based on blockchain and deep reinforcement learning, optimization methods based on software-defined orchestration technology, unified scheduling methods based on virtual network elements and physical devices, and automatic orchestration and deployment methods for security service chains based on particle swarm algorithms. The above methods can be used to achieve flexible orchestration of service chains in different situations or scenarios. The full-scenario link maintenance method uses multiple intelligent link maintenance methods to ensure that the border security stack system can respond quickly and maintain network quality even when failures occur at all levels of the network; A unified management method for intelligent security capabilities is also provided at the operation and maintenance control layer. The unified management method for intelligent security capabilities enables the system to achieve standardized and normalized unified management of multi-category heterogeneous networks.

2. The network border security stack system according to claim 1, characterized in that: The full-scenario link protection method provides a complete integrated link protection capability to deal with various abnormal situations through multiple bypass mechanisms, including hardware bypass, software bypass, service chain bypass and security network element bypass.

3. The network border security stack system according to claim 2, characterized in that: When the hardware device is powered off or restarted, the hardware Bypass technology will be used to ensure the normal forwarding of business traffic, ensuring that the device does not affect the business of the entire machine; a direct connection line is set between the input and output of the hardware device. If the device is powered off or restarted, the business traffic will be forwarded directly from the input end to the output end, thereby bypassing the hardware layer.

4. The network border security stack system according to claim 2, characterized in that: If the system platform layer is undergoing a device upgrade, the system platform layer will be bypassed, and traffic will be forwarded directly through the physical hardware layer instead of flowing through the system platform layer and its upper layers. This ensures normal forwarding of service traffic and does not affect the service of the entire machine.

5. The network border security stack system according to claim 2, characterized in that: If the service chain does not have any security NEs or does not have security NEs in normal state, the traffic will bypass the entire service chain and be forwarded directly through the system platform layer to ensure the normal forwarding of business traffic and ensure that the business of the entire machine is not affected.

6. The network border security stack system according to claim 2, characterized in that: When a security network element fails, traffic will bypass the abnormal security network element when flowing through various security network elements on the service chain and flow normally through other security network elements on the chain.

7. The network border security stack system according to claim 1, characterized in that: The unified management method of intelligent security capabilities includes: a unified configuration management method for network elements and a differentiated redundancy management method for network element configuration. The unified configuration management module for network elements is responsible for managing and configuring all security devices in the security stack. The unified configuration management module for network elements performs unified configuration and management of security network elements through standardized interfaces.

8. The network border security stack system according to claim 7, characterized in that: The unified configuration management method for network elements abstracts the core functions of each security network element and extracts the important common parameters. At the same time, the common parameters must also meet the configuration logic of each manufacturer. Then, the interface specification for each security capability is formulated. Based on the interface specification, the corresponding configuration management function based on each type of security network element is developed, which is executed by the unified configuration management module of network elements in the security stack. This type of management function is divided into security capability configuration function and security network element upgrade management function.

9. The network border security stack system according to claim 8, characterized in that: Common parameters include: interface type, security policy, logging, upgrade management, authentication mechanism and performance indicators; interface specifications include: authentication interface, configuration management interface, log and report interface, monitoring and alarm interface, software update interface, health check interface, policy management interface and remote management interface.

10. The network border security stack system according to claim 7, characterized in that: The differentiated redundancy management method for network element configuration uses multiple components or services with the same functions to ensure that when one component fails, other components can seamlessly take over its workload, including: redundant configuration, health monitoring, fault detection, failover, load balancing, recovery management and data synchronization processes.

11. The network border security stack system according to claim 10, characterized in that: The key steps of the differentiated redundancy management method for network element configuration include: Define redundancy strategy: determine which security network elements require redundant configuration and the level of redundancy; Implement health monitoring: deploy tools or services to continuously monitor the health of each network element; Set up a fault detection mechanism: clarify the specific methods and trigger conditions for fault detection; Configure a failover plan: Design how the backup node can quickly take over services when the primary node fails; Load balancing strategy: formulate load balancing rules to distribute requests to each network element in the best way; Establish a recovery plan: Prepare detailed recovery procedures to resume normal operations as soon as possible after the failure is resolved; Data consistency assurance: Take measures to ensure data synchronization and consistency between all redundant components.

12. The network border security stack system according to claim 1, characterized in that: Optimization methods based on software-defined orchestration technology include: Optimization of data encapsulation technology: Traffic is distributed through a centrally managed traffic distribution platform. SFC is defined on the traffic distribution platform, and dynamic forwarding flow tables are stored on the corresponding resource servers for fast distribution of intermediate traffic. For data that needs to go through SFC, the traffic distribution platform directly forwards the original data packet to the corresponding SFC node device. Since the data is not modified, no special protocol processing is required on the node device. Optimization of network element allocation method: By optimizing the network element allocation scheduling algorithm, different security network elements on the service chain are allocated to the same resource node as much as possible. From the perspective of data transmission path, the length of the physical network data link path and the length of the virtual network data link path are reduced; Service chain scheduling optimization: The traffic diversion platform is the management entrance of the entire security stack, where users configure security policies and service chain policies. The traffic diversion platform has a global perspective, knows the distribution of all traffic, and the complete definition of the service chain policy, and pushes the forwarding flow table to the resource node based on the policy matching situation. The resource node is the executor of the forwarding policy and relies on the forwarding flow table to forward the message to the virtual network element. The switching board is responsible for load balancing the access traffic to prevent a single resource node from becoming a performance bottleneck.

13. The network border security stack system according to claim 12, characterized in that: When the network element processing power and physical hardware are the same, the optimization method based on software-defined orchestration technology optimizes the data packet size and data path length.

14. The network border security stack system according to claim 12, characterized in that: When the network element allocation method is optimized, the security network elements are scheduled to the resource boards in the resource nodes using a round-robin scheduling algorithm based on the resource boards; the same security network element group will be sent to a resource node. Since the security network element group ID is the same but the security network element ID is different in the same security network element group, a security network element is created in each security network element group and a priority scheduling strategy is implemented based on the security network element ID.

15. The network border security stack system according to claim 12, characterized in that: When optimizing service chain scheduling, when network elements are on the same resource node, When the first packet Pkt1 of a flow Flow1 arrives at the system, the switch board S1 load balances it to the resource board R1. Since the flow table of R1 is empty, it does not know how to process this packet, so it redirects it to the distribution platform M1 for processing. This process is expressed as: Pkt1: S1->R1(rule miss)->M1. The traffic distribution platform M1 receives the packet Pkt1 of flow Flow1 and performs the standard L2 / L3 forwarding process. In the process of matching the service chain policy, it is found that the packet hits the service chain Chain 1: V1->V2, that is, it needs to pass through two virtual network elements V1 and V2, and these two network elements are on R1. Therefore, the traffic distribution platform M1 will send the following forwarding flow table to R1: Rule1: Flow1: V1->V2->Port1; Port1's L2 / L3 forwarding outbound interface; The traffic distribution platform M1 sends Rule1 to R1. This process is represented as: Pkt1: M1 (pushrule1) -> R1; The traffic distribution platform M1 dispatches the message back to R1 for processing again, and performs the forwarding action of V1->V2->Port1: First, the message is sent to V1, and after V1 completes processing, it is sent to V2, and after V2 completes processing, it is forwarded from Port1; This process is recorded as: Pkt1: R1 (rule1 hit) -> V1 -> V2 -> Port1; When subsequent messages Pkt2, Pkt3, ..., Pktn of Flow1 arrive, firstly, S1 ensures that the messages will be hashed to the same resource board R1. Secondly, R1 already contains the forwarding information of Flow1, so it can handle the forwarding of Flow1 normally without the direct participation of the diversion platform M1. This process is recorded as: Pkt2, Pkt3, ..., Pktn: S1->R1(rule1 hit)->V1->V2->Port1.

16. The network border security stack system according to claim 12, characterized in that: When optimizing service chain scheduling, when security network elements are in different resource nodes, When the traffic distribution platform M1 sends the flow table to R1, it knows that the next network element of V2 is on the non-local resource node R2, so it reflects this information in the forwarding table entry, Rule2: Flow2: V1->V2->R1->R2. After processing, R1 directly dispatches the message to R2.

17. The network border security stack system according to claim 1, characterized in that: The unified scheduling method based on virtual network elements and physical devices includes: including: physical network element definition and service chain unified orchestration method; Definition of physical network elements: Networks are defined into four categories: internal management network, business network, service chain serial network and service chain bypass network; interfaces are also divided into four categories: internal management interface, business network interface, serial interface and bypass interface; physical network elements only care about the networks and interfaces of serial or bypass services; Unified service chain orchestration method: Based on the differences between virtual network elements and physical network elements, the two objects are abstracted, and the attributes of the intersection of the two objects are extracted to form a new common network element object; for the service chain function, this new network element object is orchestrated, and the previous virtual network element objects and physical network element objects are no longer used. It is no longer distinguished whether the orchestration is a virtual network element or a physical network element. When distributing traffic, only the series connection or bypass interface of the network element object is concerned.

18. The network border security stack system according to claim 17, characterized in that: The internal management network is a network used for internal management. It is not externally perceived and is used to manage VNFs, including password-free jumps, VNF configuration initialization, and centralized management. This network is required for virtual network elements, but not for physical network elements. The business network is connected to the user's network business network and is used to actively provide security services based on the three-layer network; This network is mandatory for virtual network elements, but not for physical network elements. There can be multiple network elements. Each service network will have an interface connected to it in the VNF. The service chain serial network is used to orchestrate network elements and form a logical serial network. The reason why the service chain does not require routing for serial connection is that multiple VNFs are serially connected through the second layer access method. This network is selected according to the use of network elements. Network elements that need security protection on the serial chain need to be configured. Service chain bypass network: The service chain bypass network is specifically used for traffic mirroring, which is used to copy the specified traffic and distribute it to the bypass audit, analysis, and statistics network elements in the adjacent chains in the service chain; This network is also selected based on how the network elements are used. The network elements that need to perform statistical analysis on the bypass chain need to be configured.

19. The network border security stack system according to claim 18, characterized in that: Internal management interface: The internal management network is mandatory for virtual network elements, so there must be an internal management interface in the VNF. The default is the first interface, DHCP mode, and it will automatically obtain an internal network IP after startup. This IP will be used for password-free jumps and RESTAPI configuration delivery, but it is not required for physical network elements; Service network interface: Since service network is mandatory for virtual network elements and there is at least one, there will be an interface for each service network in the VNF. Service-oriented VNFs will provide relevant security protection through this interface, which is not required for physical network elements. Serial interface: If you want to orchestrate the network element into the serial chain of the service chain, you need to select the serial network when creating or defining the network element. A pair of interfaces will correspond to the virtual network element, and the physical network element needs to select a pair of interfaces on the physical device as the serial interface. This pair of interfaces is required to be included in the bridge for Layer 2 transmission, with one interface in and one interface out. The service chain orchestration engine will send the specified traffic to the serial interface of the corresponding network element in sequence according to the diversion strategy and service chain strategy, and the traffic received from the serial interface will find the next network element according to the service chain strategy, and repeat the above actions until the traffic is processed by the last network element in the serial chain of the service chain and then forwarded. Bypass interface: If you want to orchestrate the VNF into the bypass chain of the service chain, you need to select the bypass network when creating or defining the network element. There will be an additional corresponding interface in the VNF, and the physical network element needs to select an interface on the physical device as the bypass interface. The interface needs to be set to bypass mode to receive and process the mirrored traffic; The service chain orchestration engine will copy the specified traffic according to the traffic diversion strategy and service chain strategy, and send it to the bypass interface of each network element in the bypass chain.

20. The network border security stack system according to claim 19, characterized in that: Abstraction of two types of objects includes: In addition to some of its own attributes, virtual network elements also include network-related attributes, which include internal management network, service network, serial network, bypass network, and corresponding network interface information; In addition to its own characteristics, the physical network element also includes network-related attributes, and the network-related attributes only include the corresponding interface information of the series network, bypass network and corresponding network.

21. The network border security stack system according to claim 20, characterized in that: Virtual network element objects and physical network element objects are eventually converted into new network element objects, which extract and retain the attributes of the intersection part, and refine the four types of networks and the corresponding four types of interfaces to form independent interface objects. After the service chain references the new network element object, the compatibility of virtual and physical network elements has been completed. In subsequent use, there is no need to consider the relevant differences. You only need to define the required virtual network elements and physical network elements and directly reference them in the service chain to form a virtual-real hybrid service chain.

22. The network border security stack system according to claim 1, characterized in that: The infrastructure-as-code implementation methods of the security resource pool include: S51, obtaining the infrastructure configuration of the security resource pool and saving it to the version control system; S52. Load the configuration of the security resource pool from the version control system and deploy it to the security resource pool.

23. The network border security stack system according to claim 22, characterized in that: The S51 specifically includes: Step S511, configure in the security resource pool interface; Step S512: The configuration management module sends configurations to network elements in the security resource pool; Step S513: The configuration management module saves the configuration; Step S514: The infrastructure as code module obtains the network element configuration file and the topology connection relationship configuration whose configuration has been changed; Step S515: The infrastructure as code module saves the complete configuration file and topology connection relationship configuration after the network element is changed to the version control system.

24. The network border security stack system according to claim 23, characterized in that: The security resource pool includes: network elements, configuration management modules, infrastructure as code modules, and version control systems; The configuration management module reads the configuration of the network elements in the security resource pool, and is also used to send the configuration to the network elements and save the configuration; The infrastructure as code module describes the infrastructure as code text and performs the saving and rollback of network element configuration and topology relationships; The version control system is used to save the historical configuration of network elements. The security resource pool saves the configuration files of all network elements it contains and the topological connection relationships between network elements in the version control system in text form.

25. The network border security stack system according to claim 23, characterized in that: The S52 specifically includes the following steps: Step S521: Select the time point to which the configuration should be rolled back on the security resource pool interface, and perform the rollback operation; Step S522: The infrastructure as code module pulls the configuration files and topology connection relationship configurations of the network elements on the specified date from the version control system, and sends them to the configuration management module; Step S523: The configuration management module sends configurations to network elements in the security resource pool; Step S524: The configuration management module saves the configuration.

26. The network border security stack system according to claim 25, characterized in that: Select a specific network element to perform a rollback or select the entire security resource pool to perform a rollback.

27. The network border security stack system according to claim 1, characterized in that: The automatic orchestration and deployment method of security service chain based on particle swarm algorithm includes the following steps: Step S61: Initialize the particle swarm of the automatic orchestration deployment model and randomly generate a group of particles, each particle representing a possible strategy combination, also called an orchestration solution; Step S62, calculate fitness: calculate the fitness value of each particle according to the fitness function, the fitness function is: Fitness(x,y)=x 2 +y 2 Among them, x and y represent two input variables, the input variable x is defined as the number of user requests, and the input variable y is defined as the bandwidth consumption; The particle swarm algorithm evaluates the position of each particle based on this fitness function and guides the particles to move to areas with smaller fitness values, thereby finding the minimum value of the fitness function; Step S63: Perform fitness evaluation on each particle according to a predetermined fitness function; Step S64, record the position of the particle with the best fitness in the particle swarm, that is, the global optimal solution; update the speed and position of each particle by considering the individual historical optimal position and the global optimal position; Step S65, repeating steps S62 to S64 until the termination condition is met, and obtaining the position of the particle with the best fitness, which is the optimal solution, corresponding to the best security service chain strategy combination; Step S66: deploy and adjust the security service chain according to the best strategy combination represented by the optimal solution, continuously optimize and adjust, and complete the automatic orchestration process.

28. The network border security stack system according to claim 27, characterized in that: Before the step S1, it also includes: a sample parameter preprocessing process, specifically, by performing programmable preprocessing settings on the network traffic in the virtualized environment, two-way support for automatic orchestration of the virtualized security service chain is completed.

29. The network border security stack system according to claim 27, characterized in that: During the automatic orchestration process, various constraints need to be considered, including: the number of requests on the security service chain must be less than or equal to the amount of resources that the corresponding physical node can provide; the bandwidth request amount must also be less than or equal to the bandwidth provided on the virtual link; there can only be one mapping between the virtual link and the actual physical path.

30. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm as claimed in claim 27, characterized in that: The automatic orchestration deployment model also includes: a policy conflict decision node, a network traffic scheduling node and a security resource pool; In the case of conflicts in automatic orchestration decisions, the policy conflict decision node first automatically provides network security protection services for business traffic through the open policy scheduling interface; due to the influence of different previous and subsequent policies, there is a high probability that there will be certain conflicts between the execution actions. At this time, the optimal policy combination obtained based on the particle swarm algorithm is used to automatically coordinate and manage the relationship between various services, so that the policy conflict decision node can correctly orchestrate network flow transmission according to the priority of the security service chain; the policy conflict decision node also transmits the scheduling optimization decision results to the corresponding network traffic scheduling node; The network traffic scheduling node is responsible for analyzing and managing the virtualized security network elements in the security resource pool, realizing automatic monitoring of network element load information, outputting corresponding security traffic scheduling configuration according to the security service chain orchestration strategy, parsing the security network element type, and evaluating the best policy scheduling solution from the scheduling optimization decision results of the policy conflict decision node. Through the message queue, the actually configured security traffic scheduling information strategy is automatically transmitted to the virtualized security network elements in the security resource pool to realize the directional processing of data traffic; The message queue uses asynchronous communication. The sender in the security resource pool sends the message to the queue without waiting for the receiver's response, which improves the response speed of the security service chain.

Images