Cloud data center security protection method and device, electronic equipment and medium

Abstract

The invention provides a cloud data center security protection method and device, electronic equipment and a medium, and is applied to a cloud data center, and the cloud data center comprises an exit domain, a switching domain, a core service domain and an operation and maintenance management domain. The method comprises the following steps: respectively configuring corresponding dynamic heterogeneous redundant architectures in an exit domain, a switching domain, a core service domain and an operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture comprises a plurality of heterogeneous execution bodies; respectively configuring a target resource and a security protection strategy for each heterogeneous executor configured in each domain; configuring a logic strategy that minority obeys majority for a plurality of heterogeneous executors in each domain, and a security processing strategy when the heterogeneous executors are attacked; and each domain performs data processing based on the corresponding dynamic heterogeneous redundant architecture to determine a security protection result, so that the security of the cloud data center is enhanced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a cloud data center security protection method, device, electronic device and medium. Background Art

[0002] Most traditional network security technologies are based on signature-based detection methods, which identify malicious behaviors in the network through the characteristics of known attacks such as viruses and Trojans. Although this method can effectively prevent known attacks, it uses a static defense strategy, that is, preset defense rules based on known vulnerabilities and attack patterns. The protection capabilities for unknown attacks or zero-day vulnerabilities are limited, making it difficult to cope with the growing security threats. In addition, traditional network security models are mainly designed for traditional physical information systems, without considering the virtual network characteristics brought about by cloud data center virtualization. Summary of the invention

[0003] In view of this, the purpose of the present application is to provide a cloud data center security protection method, device, electronic device and medium, which can improve the security protection performance of the cloud data center.

[0004] A cloud data center security protection method provided in an embodiment of the present application is applied to a cloud data center, wherein the cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the method includes the following steps:

[0005] A corresponding dynamic heterogeneous redundant architecture is configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes a plurality of heterogeneous executors;

[0006] According to the specific needs of each domain, each heterogeneous executor configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain is configured with target resources and security protection strategies;

[0007] Configure the majority logic strategy for multiple heterogeneous executors in each domain, as well as the security processing strategy when the heterogeneous executors are attacked;

[0008] The egress domain, switching domain, core business domain, and operation and maintenance management domain in the cloud data center respectively perform data processing based on corresponding dynamic heterogeneous redundant architectures to determine security protection results.

[0009] In some embodiments, in the cloud data center security protection method, the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center respectively perform data processing based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result, including:

[0010] The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center respectively launch some heterogeneous executors from the corresponding dynamic heterogeneous redundant architecture to determine multiple online executors;

[0011] The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain respectively process the target data based on the corresponding multiple online executive bodies to determine whether there is an online executive body that has been attacked;

[0012] If so, the attacked online executable body is processed based on the security processing strategy when the heterogeneous executable body is attacked.

[0013] In some embodiments, in the cloud data center security protection method, the attacked online executable body based on the security processing strategy when the heterogeneous executable body is attacked includes:

[0014] Taking the attacked online executor offline, and determining the heterogeneous executor to be taken offline;

[0015] Launch a new heterogeneous executor from the redundant heterogeneous executors of the dynamic heterogeneous redundant architecture;

[0016] For the offline heterogeneous executor, security cleaning is performed on the offline heterogeneous executor, and the security protection strategy in the offline heterogeneous executor is modified.

[0017] In some embodiments, in the cloud data center security protection method, the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain respectively process the target data based on the corresponding multiple online executable bodies to determine whether there is an online executable body that is attacked; including:

[0018] For the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain, the target data to be processed in each domain is distributed to the dynamic heterogeneous redundant architecture of the domain;

[0019] Multiple online executors in the dynamic heterogeneous redundant architecture of the domain receive the same target data processing task for the target data, and process the target data respectively, and each online executor outputs a corresponding target data processing result respectively;

[0020] Compare the target data processing results of each online executable body in the domain to determine whether there is an online executable body that has been attacked.

[0021] In some embodiments, in the cloud data center security protection method, comparing the target data processing results of each online executable body in the domain to determine whether there is an online executable body under attack includes:

[0022] Compare the target data processing results of each online execution body in the domain, and determine the final target data processing result based on the principle of minority obeys majority;

[0023] Determining whether there is an abnormal target data processing result that is inconsistent with the final target data processing result;

[0024] If so, it is determined that the online executable body corresponding to the abnormal target data processing result is attacked.

[0025] In some embodiments, in the cloud data center security protection method, corresponding dynamic heterogeneous redundant architectures are configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, respectively, including:

[0026] Incrementally deploying the corresponding dynamic heterogeneous redundant architecture in the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center respectively;

[0027] After the dynamic heterogeneous redundant architecture in each domain is deployed, the heterogeneous executors in the dynamic heterogeneous redundant architecture in the deployment domain are incrementally deployed based on the data flow.

[0028] In some embodiments, in the cloud data center security protection method, corresponding dynamic heterogeneous redundant architectures are configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, respectively, including:

[0029] Based on the networking characteristics of the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, respectively, a mimic application strategy of a dynamic heterogeneous redundant architecture of the domain is configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain;

[0030] Among them, the export domain deploys a mimetic firewall, the exchange domain deploys a mimetic switch and a mimetic router, the operation and maintenance management domain deploys a mimetic firewall, a mimetic bastion host, and a mimetic operation and maintenance situation awareness platform; the core business domain deploys a mimetic cloud platform.

[0031] In some embodiments, a cloud data center security protection device is further provided, the device is applied to a cloud data center, the cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the device includes:

[0032] A first configuration module is used to configure corresponding dynamic heterogeneous redundant architectures in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes multiple heterogeneous execution bodies;

[0033] The second configuration module is used to configure target resources and security protection strategies for each heterogeneous execution body configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain according to the specific needs of each domain;

[0034] The third configuration module is used to configure the minority obeys majority logic strategy for multiple heterogeneous execution bodies in each domain, and the security processing strategy when the heterogeneous execution body is attacked;

[0035] The determination module is used to enable the export domain, switching domain, core business domain, and operation and maintenance management domain in the cloud data center to perform data processing based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result.

[0036] In some embodiments, an electronic device is also provided, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the cloud data center security protection method are performed.

[0037] In some embodiments, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the cloud data center security protection method are executed.

[0038] The present application provides a cloud data center security protection method, device, electronic device and medium, which are applied to a cloud data center. The cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the method includes the following steps: respectively configuring a corresponding dynamic heterogeneous redundant architecture in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes a plurality of heterogeneous executors; respectively configuring target resources and security protection strategies for each heterogeneous executor configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain according to the specific needs of each domain; and configuring the corresponding dynamic heterogeneous redundant architecture in each domain. A logical strategy of minority obeying majority for multiple heterogeneous executors, and a security processing strategy when a heterogeneous executor is attacked; data processing is performed in the export domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result; security defense is performed based on the dynamic heterogeneous redundant architecture, and the entire cloud data center presents a protection effect that is difficult for attackers to detect, penetrate, attack, and utilize the results of the attack. It takes the initiative and turns from passive to active, thereby enhancing the cloud data center's security, reliability, flexibility, and ability to cope with complex environments, and can better provide business services to users. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flow chart of the cloud data center security protection method described in an embodiment of the present application is shown;

[0041] Figure 2 A flow chart of a method for determining a security protection result according to an embodiment of the present application is shown;

[0042] Figure 3 A schematic diagram of the structure of the dynamic heterogeneous redundant architecture described in an embodiment of the present application is shown;

[0043] Figure 4 A flow chart of a method for determining whether there is an attacked online executable body according to an embodiment of the present application is shown;

[0044] Figure 5 A schematic diagram of the structure of the cloud data center security protection device according to an embodiment of the present application is shown;

[0045] Figure 6 A schematic structural diagram of an electronic device described in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0046] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0047] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0048] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0049] Most traditional network security technologies are based on signature-based detection methods, which identify malicious behaviors in the network through the characteristics of known attacks such as viruses and Trojans. Although this method can effectively prevent known attacks, it uses a static defense strategy, that is, preset defense rules based on known vulnerabilities and attack patterns. The protection capabilities for unknown attacks or zero-day vulnerabilities are limited, making it difficult to cope with the growing security threats. In addition, traditional network security models are mainly designed for traditional physical information systems, without considering the virtual network characteristics brought about by cloud data center virtualization.

[0050] Specifically, for traditional security networks, attackers use network scanning, vulnerability scanning, wireless detection, search engines, phishing, junk searches, and other means to obtain key information of the entire service system, such as hardware platform information, operating system information, software service information, etc., and use weapon construction, payload delivery, and other means to exploit various possible vulnerabilities in the entire service system, implant remote access Trojans or backdoors in the information system, and continuously control the hijacked or tampered information system to achieve the purpose of profit or theft. The traditional security network's defense strategy, which is designed based on the preset defense rules of known vulnerabilities and attack patterns, cannot effectively defend against unknown attacks or zero-day vulnerabilities.

[0051] Based on this, the embodiments of the present application provide a cloud data center security protection method, device, electronic device and medium, which are applied to a cloud data center, wherein the cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the method includes the following steps: respectively configuring corresponding dynamic heterogeneous redundant architectures in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes multiple heterogeneous executors; according to the specific needs of each domain, respectively configuring target resources and security protection strategies for each heterogeneous executor configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain; configuring each domain The logic strategy of minority obeying majority for multiple heterogeneous executors and the security processing strategy when the heterogeneous executors are attacked are implemented; the export domain, switching domain, core business domain and operation and maintenance management domain in the cloud data center respectively perform data processing based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result; based on the dynamic heterogeneous redundant architecture for security defense, the entire cloud data center presents a protection effect that is difficult for attackers to detect, penetrate, attack and utilize the results of the attack, taking the initiative and changing from passive to active, thereby enhancing the cloud data center's security, reliability, flexibility, and ability to cope with complex environments, and can better provide business services to users.

[0052] Please refer to Figure 1 , Figure 1 A flow chart of a cloud data center security protection method according to an embodiment of the present application is shown. The cloud data center security protection method is applied to a cloud data center, and the cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the method includes the following steps S101-S104:

[0053] S101, respectively configuring a corresponding dynamic heterogeneous redundant architecture in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes a plurality of heterogeneous executors;

[0054] S102, according to the specific needs of each domain, respectively configure target resources and security protection strategies for each heterogeneous execution body configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain;

[0055] S103, configuring a logic strategy of minority obeying majority for multiple heterogeneous executives in each domain, and a security processing strategy when a heterogeneous executive is attacked;

[0056] S104: The egress domain, switching domain, core business domain, and operation and maintenance management domain in the cloud data center respectively process data based on corresponding dynamic heterogeneous redundant architectures to determine security protection results.

[0057] In the step S101, corresponding dynamic heterogeneous redundant architectures are respectively configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes a plurality of heterogeneous executors.

[0058] Specifically, the number of heterogeneous execution bodies included in the dynamic heterogeneous redundant architecture is an odd number.

[0059] The heterogeneous executors are the core components of the architecture. The heterogeneous executors refer to hardware or software components with the same functions but different implementation methods. These heterogeneous executors are physically or logically independent of each other, and can execute the same tasks or operations in parallel and output their respective processing results for the same task.

[0060] According to the needs of the domain, heterogeneous executors with different implementations but equivalent functions are selected. The heterogeneous executors can be hardware components (such as switches and routers of different models) or software components (such as operating systems and databases of different versions).

[0061] Specifically, in the cloud data center security protection method, corresponding dynamic heterogeneous redundant architectures are configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, respectively, including:

[0062] Incrementally deploying the corresponding dynamic heterogeneous redundant architecture in the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center respectively;

[0063] After the dynamic heterogeneous redundant architecture in each domain is deployed, the heterogeneous executors in the dynamic heterogeneous redundant architecture in the deployment domain are incrementally deployed based on the data flow.

[0064] That is to say, in the core computer room environment, boundary, network, and operation and maintenance levels, based on the analysis of the existing resources of the cloud computing center, the user's traditional security equipment and mimetic defense security equipment are combined and applied through incremental deployment, mimetic transformation and other means.

[0065] At the same time, as the scale of cloud data centers expands and business needs grow, the dynamic heterogeneous redundant architecture can easily expand new heterogeneous executors and resources to meet the expansion needs of the system.

[0066] The corresponding dynamic heterogeneous redundant architecture is configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center, respectively, including the following steps:

[0067] Based on the networking characteristics of the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, respectively, a mimic application strategy of a dynamic heterogeneous redundant architecture of the domain is configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain;

[0068] Among them, the export domain deploys a mimetic firewall, the exchange domain deploys a mimetic switch and a mimetic router, the operation and maintenance management domain deploys a mimetic firewall, a mimetic bastion host, and a mimetic operation and maintenance situation awareness platform; the core business domain deploys a mimetic cloud platform.

[0069] At the export domain (border), switching domain (network), core business domain (core computer room environment), and operation and maintenance management domain (operation and maintenance) levels, deploy corresponding mimic application strategies based on the user's existing business development and networking characteristics.

[0070] Incrementally deploy mimetic firewalls at the edge of the cloud data center to enable the system edge to acquire mimetic defense capabilities, solve edge security issues, and achieve network access control between various security domains.

[0071] By replacing or incrementally deploying mimetic switches in the switching domain of a cloud data center, the network layer can gain the ability to defend against unknown vulnerabilities and unknown backdoors, effectively locate network threats and anomalies in the switching domain, help administrators quickly deal with them, and enhance the inherent security of the switch and its ability to resist attacks.

[0072] Replace or incrementally deploy firewalls, bastion hosts, and operation and maintenance situation awareness platforms in the operation and maintenance domain of the cloud data center, so that the operation and maintenance level can obtain the total operation and maintenance export for policy control and security protection, and record and analyze the operation behavior of the operation and maintenance personnel to timely discover and prevent potential security threats; analyze and process the operating status of mimetic devices in real time to timely discover potential security threats.

[0073] In the business domain of the cloud data center, the mimetic cloud platform can be replaced or incrementally deployed according to cost requirements, and the cloud platform resource level can obtain the capabilities of mimetic device monitoring, attack protection, routing management, intrusion prevention, virus defense, and application identification.

[0074] In the step S102, target resources and security protection policies are configured for each heterogeneous execution body configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain, respectively, according to the specific requirements of each domain.

[0075] Exemplarily, the target resource configuration of the egress domain requires configuring bandwidth resources to ensure smooth data transmission, as well as hardware devices such as routers and switches.

[0076] For example, the mimetic firewall of the egress domain needs to be configured with access control policies to prevent external attacks and illegal access, filtering and URL filtering functions, prevent the spread and access of malicious content, and so on.

[0077] Exemplarily, for a switching domain, the target resource configuration needs to configure an appropriate number of switches and link resources according to the number of devices and traffic requirements in the switching domain; the security protection strategy includes security auditing, vulnerability scanning, etc.

[0078] Exemplarily, the target resource configuration of the core business domain includes resource configuration of servers, storage devices and network devices, virtual machines, containers, etc., and adopts virtualization technology and resource pooling technology, which can be combined with the characteristics of cloud data centers to improve resource utilization and flexibility; security protection strategies include virtual firewalls, data encryption and integrity verification functions, etc.

[0079] Exemplarily, the security protection strategy of the operation and maintenance management domain includes deploying identity authentication, access control mechanisms, and the like.

[0080] In the step S103, a logic strategy of the minority obeys the majority for multiple heterogeneous execution bodies in each domain and a security processing strategy when the heterogeneous execution bodies are attacked are configured.

[0081] The security processing strategy includes scheduling, arbitration, and feedback strategies.

[0082] Specifically, the security processing strategy includes offline, cleaning, and modification strategies for the attacked heterogeneous executor, and an online strategy for re-online a new heterogeneous executor from the executor pool.

[0083] In the step S104, the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center perform data processing based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result.

[0084] The security protection result is: whether the heterogeneous execution body in the dynamic heterogeneous redundant architecture in any domain of the cloud data center is abnormal. If it is abnormal, it means that the cloud data center is attacked.

[0085] Please refer to Figure 2 In the cloud data center security protection method, the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center perform data processing based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result, including the following steps S201-S203:

[0086] S201, the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center respectively launch some heterogeneous executors from the corresponding dynamic heterogeneous redundant architecture, and determine multiple online executors;

[0087] S202, the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain respectively process the target data based on the corresponding multiple online executive bodies to determine whether there is an online executive body that has been attacked;

[0088] S203: If so, the attacked online executable body is processed based on the security processing strategy when the heterogeneous executable body is attacked.

[0089] The security processing strategy based on the heterogeneous executable body when being attacked, the attacked online executable body, includes:

[0090] Taking the attacked online executor offline, and determining the heterogeneous executor to be taken offline;

[0091] Launch a new heterogeneous executor from the redundant heterogeneous executors of the dynamic heterogeneous redundant architecture;

[0092] For the offline heterogeneous executor, security cleaning is performed on the offline heterogeneous executor, and the security protection strategy in the offline heterogeneous executor is modified.

[0093] Please refer to Figure 3 Based on the dynamic heterogeneous redundant architecture, the cloud data center presents N online executors (N is an odd number of 3, 5, 7...) to the attacker, namely P1-Pn; the attacker cannot simultaneously detect the vulnerabilities of the N online executors, that is, cannot simultaneously launch attacks. Even if the attacker controls one of the executors, the system will block the attack due to the logic strategy of minority obeys majority. At the same time, the executor attacked this time is offline, cleaned, and the strategy is modified, and a new executor is re-launched from the executor pool. The entire system presents a protection effect that is difficult for the attacker to detect, penetrate, attack, and utilize the attack results, taking the initiative and turning passivity into initiative.

[0094] Based on the offline operation of the attacked online executor, the online operation of a new heterogeneous executor, and the cleaning and modification strategies, the dynamic heterogeneous redundant architecture can dynamically adapt to system changes and external threats, and maintain system stability and performance through dynamic reconstruction and strategy adjustment.

[0095] Specifically, once it is confirmed that a heterogeneous executor has been attacked, the offline operation is triggered and the heterogeneous executor is removed from the service to prevent the attack from spreading further or affecting other system components. At the same time, the identity information of the heterogeneous executor that has been taken offline is recorded and confirmed for subsequent security cleaning and policy adjustments.

[0096] A new heterogeneous executor is launched from the redundant heterogeneous executors of the dynamic heterogeneous redundant architecture. Specifically, there will be multiple redundant heterogeneous executors as backups in the dynamic heterogeneous redundant architecture. A healthy and unattacked executor will be selected from these redundant heterogeneous executors to replace the offline executor. The selected redundant heterogeneous executor will be launched online, and the corresponding services or applications will be started to ensure the continuity and stability of the cloud data center.

[0097] Conduct security cleaning on the heterogeneous executors that have been taken offline, and modify their security protection strategies. Specifically, conduct comprehensive security cleaning on the heterogeneous executors that have been taken offline, including removing malware, fixing vulnerabilities, and restoring system configurations to completely eliminate traces of attacks and prevent attackers from using the executors to attack again. Adjust and optimize the security protection strategies in the heterogeneous executors that have been taken offline based on the types and methods of attacks, for example, updating firewall rules, strengthening identity authentication mechanisms, and deploying higher-level encryption technologies. After security cleaning and strategy adjustments, re-evaluate the heterogeneous executors that have been taken offline. If it is confirmed that they have recovered their security and meet business needs, consider putting them back online.

[0098] Please refer to Figure 4 The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain respectively process the target data based on the corresponding multiple online execution bodies to determine whether there is an online execution body under attack; including the following steps S401-S403:

[0099] S401, for the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain, respectively distributing the target data to be processed in each domain to the dynamic heterogeneous redundant architecture of the domain;

[0100] S402, multiple online execution bodies in the dynamic heterogeneous redundant architecture of the domain receive the same target data processing task for the target data, and process the target data respectively, and each online execution body outputs a corresponding target data processing result respectively;

[0101] S403: Compare the target data processing results of each online executable body in the domain to determine whether there is an online executable body that has been attacked.

[0102] Here, due to the possible heterogeneity between the executables (i.e. different hardware, software or algorithms), the target data processing results they output may be different. However, in most cases, these differences should be within an acceptable range, and consistent target data processing results can be determined through subsequent comparison and verification.

[0103] In some embodiments, in the security protection method for the cloud data center, comparing the target data processing results of each online executable body in the domain to determine whether there is an online executable body that has been attacked includes:

[0104] Compare the target data processing results of each online execution body in the domain, and determine the final target data processing result based on the principle of minority obeys majority;

[0105] Determining whether there is an abnormal target data processing result that is inconsistent with the final target data processing result;

[0106] If so, it is determined that the online executable body corresponding to the abnormal target data processing result is attacked.

[0107] Please refer to Figure 3 , multi-mode decision is made on the output results of N heterogeneous executors; the principle of minority obeys majority is adopted, that is, when the output results of most heterogeneous executors are consistent, the result is output as the final result.

[0108] Based on the same inventive concept, the embodiments of the present application also provide a cloud data center security protection device corresponding to the cloud data center security protection method. Since the principle of solving the problem by the device in the embodiments of the present application is similar to the above-mentioned cloud data center security protection method in the embodiments of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0109] Please refer to Figure 5 , Figure 5 The structure diagram of the cloud data center security protection device according to the embodiment of the present application is shown; the cloud data center security protection device is applied to a cloud data center, and the cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the device includes:

[0110] The first configuration module 501 is used to configure corresponding dynamic heterogeneous redundant architectures in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes multiple heterogeneous execution bodies;

[0111] The second configuration module 502 is used to configure target resources and security protection strategies for each heterogeneous execution body configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain according to the specific needs of each domain;

[0112] The third configuration module 503 is used to configure the logic strategy of minority obeys majority for multiple heterogeneous execution bodies in each domain, and the security processing strategy when the heterogeneous execution bodies are attacked;

[0113] The determination module 504 is used to enable the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center to perform data processing based on the corresponding dynamic heterogeneous redundant architectures to determine the security protection results.

[0114] In some embodiments, in the cloud data center security protection device, the determination module, when making the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center perform data processing based on the corresponding dynamic heterogeneous redundant architecture respectively to determine the security protection result, is specifically used to:

[0115] The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center respectively launch some heterogeneous executors from the corresponding dynamic heterogeneous redundant architecture to determine multiple online executors;

[0116] The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain respectively process the target data based on the corresponding multiple online executive bodies to determine whether there is an online executive body that has been attacked;

[0117] If so, the attacked online executable body is processed based on the security processing strategy when the heterogeneous executable body is attacked.

[0118] In some embodiments, in the cloud data center security protection device, the determination module, when determining the attacked online executable body based on the security processing strategy when the heterogeneous executable body is attacked, is specifically used to:

[0119] Taking the attacked online executor offline, and determining the heterogeneous executor to be taken offline;

[0120] Launch a new heterogeneous executor from the redundant heterogeneous executors of the dynamic heterogeneous redundant architecture;

[0121] For the offline heterogeneous executor, security cleaning is performed on the offline heterogeneous executor, and the security protection strategy in the offline heterogeneous executor is modified.

[0122] In some embodiments, in the cloud data center security protection device, the determination module, when causing the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain to process the target data based on the corresponding multiple online executive bodies, respectively, and determining whether there is an online executive body that has been attacked, is specifically used to:

[0123] For the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain, the target data to be processed in each domain is distributed to the dynamic heterogeneous redundant architecture of the domain;

[0124] Multiple online executors in the dynamic heterogeneous redundant architecture of the domain receive the same target data processing task for the target data, and process the target data respectively, and each online executor outputs a corresponding target data processing result respectively;

[0125] Compare the target data processing results of each online executable body in the domain to determine whether there is an online executable body that has been attacked.

[0126] In some embodiments, in the cloud data center security protection device, the determination module, when comparing the target data processing results of each online executable body in the domain to determine whether there is an online executable body under attack, is specifically used to:

[0127] Compare the target data processing results of each online execution body in the domain, and determine the final target data processing result based on the principle of minority obeys majority;

[0128] Determining whether there is an abnormal target data processing result that is inconsistent with the final target data processing result;

[0129] If so, it is determined that the online executable body corresponding to the abnormal target data processing result is attacked.

[0130] In some embodiments, the cloud data center security protection device further includes:

[0131] A fourth configuration module is used to incrementally deploy the corresponding dynamic heterogeneous redundant architecture in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center respectively;

[0132] After the dynamic heterogeneous redundant architecture in each domain is deployed, the heterogeneous executors in the dynamic heterogeneous redundant architecture in the deployment domain are incrementally deployed based on the data flow.

[0133] In some embodiments, in the cloud data center security protection device, the first configuration module, when configuring corresponding dynamic heterogeneous redundant architectures in the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, is specifically used to:

[0134] Based on the networking characteristics of the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, respectively, a mimic application strategy of a dynamic heterogeneous redundant architecture of the domain is configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain;

[0135] Among them, the export domain deploys a mimetic firewall, the exchange domain deploys a mimetic switch and a mimetic router, the operation and maintenance management domain deploys a mimetic firewall, a mimetic bastion host, and a mimetic operation and maintenance situation awareness platform; the core business domain deploys a mimetic cloud platform.

[0136] Based on the same inventive concept, an electronic device corresponding to the cloud data center security protection method is also provided in the embodiment of the present application. Since the principle of solving the problem by the electronic device in the embodiment of the present application is similar to the above-mentioned cloud data center security protection method in the embodiment of the present application, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0137] Please refer to Figure 6 , Figure 6A schematic diagram of the structure of the electronic device described in an embodiment of the present application is shown; the electronic device 600 includes: a processor 601, a memory 602 and a bus, the memory 602 stores machine-readable instructions executable by the processor 601, and when the electronic device 600 is running, the processor 601 communicates with the memory 602 through the bus, and when the machine-readable instructions are executed by the processor 601, the steps of the cloud data center security protection method are executed.

[0138] Based on the same inventive concept, a computer-readable storage medium corresponding to the cloud data center security protection method is also provided in the embodiment of the present application. Since the principle of solving the problem by the computer-readable storage medium in the embodiment of the present application is similar to the above-mentioned cloud data center security protection method in the embodiment of the present application, the implementation of the computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0139] A computer-readable storage medium stores a computer program, which executes the steps of the cloud data center security protection method when executed by a processor.

[0140] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0141] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0143] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0144] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cloud data center security protection method, characterized in that: Applied to a cloud data center, the cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the method includes the following steps: A corresponding dynamic heterogeneous redundant architecture is configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes a plurality of heterogeneous executors; According to the specific needs of each domain, each heterogeneous executor configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain is configured with target resources and security protection strategies; Configure the majority logic strategy for multiple heterogeneous executors in each domain, as well as the security processing strategy when the heterogeneous executors are attacked; The egress domain, switching domain, core business domain, and operation and maintenance management domain in the cloud data center respectively perform data processing based on corresponding dynamic heterogeneous redundant architectures to determine security protection results.

2. The cloud data center security protection method according to claim 1, characterized in that: The egress domain, switching domain, core business domain, and operation and maintenance management domain in the cloud data center respectively process data based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result, including: The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain in the cloud data center respectively launch some heterogeneous executors from the corresponding dynamic heterogeneous redundant architecture to determine multiple online executors; The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain respectively process the target data based on the corresponding multiple online executive bodies to determine whether there is an online executive body that has been attacked; If so, the attacked online executable body is processed based on the security processing strategy when the heterogeneous executable body is attacked.

3. The cloud data center security protection method according to claim 2, characterized in that: The security processing strategy based on the heterogeneous executable body being attacked, the attacked online executable body, includes: Taking the attacked online executor offline, and determining the heterogeneous executor to be taken offline; Launch a new heterogeneous executor from the redundant heterogeneous executors of the dynamic heterogeneous redundant architecture; For the offline heterogeneous executor, security cleaning is performed on the offline heterogeneous executor, and the security protection strategy in the offline heterogeneous executor is modified.

4. The cloud data center security protection method according to claim 2, characterized in that: The egress domain, the switching domain, the core business domain, and the operation and maintenance management domain respectively process the target data based on the corresponding multiple online execution bodies to determine whether there is an online execution body that is attacked; including: For the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain, the target data to be processed in each domain is distributed to the dynamic heterogeneous redundant architecture of the domain; Multiple online executors in the dynamic heterogeneous redundant architecture of the domain receive the same target data processing task for the target data, and process the target data respectively, and each online executor outputs a corresponding target data processing result respectively; Compare the target data processing results of each online executable body in the domain to determine whether there is an online executable body that has been attacked.

5. The cloud data center security protection method according to claim 4, characterized in that: Compare the target data processing results of each online executable body in the domain to determine whether there is an online executable body that has been attacked, including: Compare the target data processing results of each online execution body in the domain, and determine the final target data processing result based on the principle of minority obeys majority; Determining whether there is an abnormal target data processing result that is inconsistent with the final target data processing result; If so, it is determined that the online executable body corresponding to the abnormal target data processing result is attacked.

6. The cloud data center security protection method according to claim 1, characterized in that: The corresponding dynamic heterogeneous redundant architecture is configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center, respectively, including: Incrementally deploying the corresponding dynamic heterogeneous redundant architecture in the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center respectively; After the dynamic heterogeneous redundant architecture in each domain is deployed, the heterogeneous executors in the dynamic heterogeneous redundant architecture in the deployment domain are incrementally deployed based on the data flow.

7. The cloud data center security protection method according to claim 1, characterized in that: The corresponding dynamic heterogeneous redundant architecture is configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center, respectively, including: Based on the networking characteristics of the egress domain, switching domain, core business domain, and operation and maintenance management domain of the cloud data center, respectively, a mimic application strategy of a dynamic heterogeneous redundant architecture of the domain is configured in the egress domain, switching domain, core business domain, and operation and maintenance management domain; Among them, the export domain deploys a mimetic firewall, the exchange domain deploys a mimetic switch and a mimetic router, the operation and maintenance management domain deploys a mimetic firewall, a mimetic bastion host, and a mimetic operation and maintenance situation awareness platform; the core business domain deploys a mimetic cloud platform.

8. A cloud data center security protection device, characterized in that: Applied to a cloud data center, the cloud data center includes: an egress domain, a switching domain, a core business domain, and an operation and maintenance management domain; the device includes: A first configuration module is used to configure corresponding dynamic heterogeneous redundant architectures in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain of the cloud data center; the dynamic heterogeneous redundant architecture includes multiple heterogeneous execution bodies; The second configuration module is used to configure target resources and security protection strategies for each heterogeneous execution body configured in the egress domain, the switching domain, the core business domain, and the operation and maintenance management domain according to the specific needs of each domain; The third configuration module is used to configure the minority obeys majority logic strategy for multiple heterogeneous execution bodies in each domain, and the security processing strategy when the heterogeneous execution bodies are attacked; The determination module is used to enable the export domain, switching domain, core business domain, and operation and maintenance management domain in the cloud data center to perform data processing based on the corresponding dynamic heterogeneous redundant architecture to determine the security protection result.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the cloud data center security protection method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the cloud data center security protection method as described in any one of claims 1 to 7.

Images