Service orchestration method, electronic equipment, storage medium and program product

Abstract

The invention provides a service orchestration method, electronic equipment, a storage medium and a program product, and relates to the technical field of communication. According to the scheme, the service arrangement route of the plurality of security devices is determined through the cloud according to the data input rule and the data output rule configured by each security device, and the service arrangement is performed on the plurality of security devices according to the service arrangement route, so that the service arrangement can be realized by utilizing the resources of the cloud so as to meet the requirements of different service scenes.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a service scheduling method, electronic device, storage medium and program product. Background Art

[0002] As enterprises' demand for digital transformation grows, cloud services meet their needs for efficient and convenient services with their flexibility, scalability, and cost-effectiveness. The cloud service business model is becoming a mainstream trend in the security service industry.

[0003] In the security field, the business capabilities of a single product are often limited, and current solutions do not effectively utilize cloud service resources, making it difficult to fully cover customers' different business scenarios. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a service orchestration method, an electronic device, a storage medium, and a program product to improve the problem of difficulty in covering different service scenarios.

[0005] In a first aspect, an embodiment of the present application provides a service orchestration method, which is applied to the cloud, and the method includes:

[0006] Determining a plurality of security devices to be orchestrated, wherein the plurality of security devices are local devices registered on the cloud;

[0007] Determining the service arrangement routes of the plurality of security devices according to the data input rules and data output rules configured for each security device;

[0008] The multiple security devices are service orchestrated according to the service orchestration route.

[0009] In the above implementation process, the cloud determines the business orchestration routes of multiple security devices according to the data input rules and data output rules configured for each security device, and orchestrates the business of multiple security devices according to the business orchestration routes. In this way, business orchestration can be implemented by utilizing cloud resources to meet the needs of different business scenarios.

[0010] Optionally, determining the service orchestration routes of the plurality of security devices according to the data input rules and data output rules configured on each security device includes:

[0011] Querying the corresponding relationship between the data input rule and the data output rule from the device linkage rule library;

[0012] According to the corresponding relationship, the security devices corresponding to the data input rules and data output rules having the corresponding relationship are arranged to form a service arrangement route.

[0013] In the above implementation process, by building a device linkage rule library, the business interactions between various security devices can be conveniently constrained according to the correspondence between data input rules and data output rules in the device linkage rule library, and business orchestration can be quickly implemented according to the correspondence.

[0014] Optionally, after performing service orchestration on the plurality of security devices according to the service orchestration route, the method further includes:

[0015] The business data between the multiple security devices are transmitted according to the business arrangement route. In this way, business communication between local intranet devices can be realized, so that the security device can use the resources of other security devices to process business, solving the problem of limited business capabilities of a single local device.

[0016] Optionally, the transmitting the service data between the multiple security devices according to the service orchestration route includes:

[0017] Receiving business data and other information sent by the security device, wherein the other information includes an identifier of a data output rule and an identifier of a business arrangement route;

[0018] Querying an output rule validator corresponding to the data output rule according to the identifier of the data output rule;

[0019] Verifying the business data using the output rule verifier;

[0020] After the verification is passed, the corresponding service arrangement route is queried according to the service arrangement route identifier, and the service data is sent to the next security device in the service arrangement route.

[0021] In the above implementation process, an output rule validator is provided corresponding to the data output rule, so that the cloud verifies the received business data using the output rule validator, thereby ensuring the security of data transmission.

[0022] Optionally, the determining of the plurality of security devices to be arranged comprises:

[0023] In response to an operation of opening the orchestration interface, loading and displaying a list of security devices registered on the cloud, the list of security devices including a plurality of security devices;

[0024] In response to a drag operation on a safety device, the dragged safety device is displayed in a layout area, and a plurality of safety devices in the layout area are determined as a plurality of safety devices to be arranged.

[0025] In the above implementation process, the security device to be arranged can be selected by dragging the security device, which is convenient for user operation and improves the arrangement efficiency.

[0026] Optionally, determining the service orchestration routes of the plurality of security devices according to the data input rules and data output rules configured on each security device includes:

[0027] generating a plurality of candidate service orchestration routes for the plurality of security devices according to data input rules and data output rules configured for the plurality of security devices within the orchestration area;

[0028] In response to a selection operation of the plurality of candidate service orchestration routes, the selected candidate service orchestration routes are determined as service orchestration routes of the plurality of security devices.

[0029] In the above implementation process, the cloud generates multiple candidate business orchestration routes based on data input rules and data output rules. Users only need to choose from them according to business needs, which can simplify user operations and improve orchestration efficiency.

[0030] Optionally, determining the service orchestration routes of the plurality of security devices according to the data input rules and data output rules configured on each security device includes:

[0031] In response to a connection operation of the security devices, determining the security devices connected to each other;

[0032] Obtain data input rules and data output rules configured for interconnected security devices;

[0033] Verifying the matching of a data output rule of a first security device and a data input rule of a second security device connected to each other;

[0034] After the verification is passed, a service orchestration route of the first security device and the second security device connected to each other is determined.

[0035] In the above implementation process, the user connects the security device that needs to be orchestrated, and the cloud verifies the connected security device according to the data input rules and data output rules to determine whether it can perform business orchestration, thereby ensuring the accuracy of business orchestration.

[0036] In a second aspect, an embodiment of the present application provides a service orchestration device, which is applied to the cloud, and the device includes:

[0037] A device determination module, used to determine a plurality of security devices to be arranged, wherein the plurality of security devices are local devices registered on the cloud;

[0038] An orchestration route determination module, used to determine the service orchestration routes of the plurality of security devices according to the data input rules and data output rules configured for each security device;

[0039] An orchestration module is used to perform service orchestration on the multiple security devices according to the service orchestration route.

[0040] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method provided in the first aspect are performed.

[0041] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the method provided in the first aspect are performed.

[0042] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer program instructions, which, when read and executed by a processor, execute the steps in the method provided in the first aspect above.

[0043] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flowchart of a service arrangement method provided in an embodiment of the present application;

[0046] Figure 2 An overall flow chart of a service orchestration method provided in an embodiment of the present application;

[0047] Figure 3 A flowchart of a business data transmission provided in an embodiment of the present application;

[0048] Figure 4 A flowchart of a service arrangement process provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of a service arrangement between security devices provided in an embodiment of the present application;

[0050] Figure 6 A structural block diagram of a service arrangement device provided in an embodiment of the present application;

[0051] Figure 7 A schematic diagram of the structure of an electronic device for executing a service orchestration method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present application.

[0053] It should be noted that the terms "system" and "network" in the embodiments of the present invention can be used interchangeably. "Multiple" means two or more. In view of this, in the embodiments of the present invention, "multiple" can also be understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the previously associated objects are in an "or" relationship.

[0054] It should also be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located, and with the authorization given by the owner of the corresponding device.

[0055] An embodiment of the present application provides a business orchestration method, which is applied to the cloud. By determining multiple security devices to be orchestrated, and then determining the business orchestration routes of the multiple security devices according to the data input rules and data output rules configured for each security device, the multiple security devices are orchestrated according to the business orchestration routes. In this way, business orchestration can be implemented by utilizing cloud resources to meet the needs of different business scenarios.

[0056] Please refer to Figure 1 , Figure 1 A flowchart of a service arrangement method provided in an embodiment of the present application, the method comprising the following steps:

[0057] Step S110: Determine a plurality of safety devices to be arranged.

[0058] Among them, multiple security devices are local devices registered on the cloud, such as firewalls, vulnerability scanners, bastion hosts, etc. It can be understood that multiple security devices refer to devices isolated in the intranet. Of course, the multiple security devices to be orchestrated can belong to different intranets. These intranets are isolated from each other and cannot communicate directly. Therefore, if security devices between different intranets need to interact with each other, they need to be orchestrated through the cloud.

[0059] The cloud can be considered as a security business system that follows the device linkage rules, such as the cloud malicious sample detection system, threat intelligence platform, etc., which can be connected to the security devices tested by the client through the linkage rules.

[0060] Business orchestration can realize the data flow between security devices to meet the business needs of different scenarios. Security devices that need to be orchestrated can be registered by users on the cloud, such as entering the device information of these security devices on the cloud, including device addresses, device identifiers, etc. After the cloud receives the device information of these security devices, it can build a communication channel with the security devices based on the device addresses, so that these security devices can communicate with each other through the cloud.

[0061] In some implementations, these security devices may also be pre-registered in the cloud and have established communication with the cloud. However, when performing specific business, some security devices need to interact with each other, so these security devices need to be re-orchestrated.

[0062] The security devices in the intranet are a group of devices that follow the device linkage rules. They can be connected to the cloud based on the Message Queuing Telemetry Transport (MQTT) protocol to realize device registration on the cloud. The cloud can build a local device resource pool based on the security devices registered on the cloud. The cloud can also build a communication channel between the cloud and the security devices based on the MQTT protocol. The communication channel mainly includes basic information reporting channels, custom data interaction channels, file transfer channels, linkage rule configuration file interaction channels, etc.

[0063] After the security device is registered in the cloud, it can also regularly report heartbeat information and basic information (including device model, version, linkage rules, etc.). Based on the heartbeat information, the cloud can monitor the health of local security devices. Based on the basic information, it can match the security devices or cloud resources that can be linked through the device linkage rule library.

[0064] Step S120: Determine the service arrangement routes of the plurality of security devices according to the data input rules and data output rules configured for each security device.

[0065] Each security device is configured with data input rules and data output rules. Each security device can be configured with one or more data input rules and data output rules. The data input rules and data output rules can be used to regulate the data input and data output of the security device. For example, if a security device supports linkage with an intelligence database, the data input rules of the security device can be configured as rules for intelligence data input, and the data output rules can be configured as rules for intelligence data output. That is, the security device can obtain intelligence data in the intelligence database for threat detection, and the detected threat data can be output to the intelligence database for storage.

[0066] Each security device can be configured with corresponding data input rules and data output rules according to business needs. In some implementations, multiple data input rules and multiple data output rules can be configured in advance in the device linkage rule library on the cloud according to business needs, so as to standardize the format requirements of data input and output of security devices. When it is necessary to arrange security devices, the data input rules and data output rules required for the current business can be selected from the device linkage rule library and configured to the security device, and the corresponding relationship between the data input rules and the data output rules can be configured in the device linkage rule library. One data input rule corresponds to one data output rule, but one security device can be configured with multiple data input rules and data output rules.

[0067] Since the data input rules correspond to the data output rules, the service orchestration routes of multiple security devices can be determined based on the data input rules and the data output rules. For example, for security device 1, security device 2, and security device 3, if the data output rule of security device 1 corresponds to the data input rule of security device 2, and the data output rule of security device 2 corresponds to the data input rule of security device 3, then the service orchestration route of the three security devices can be determined as security device 1->security device 2->security device 3.

[0068] Step S130: orchestrate services for multiple security devices according to the service orchestration route.

[0069] After determining the service orchestration route, multiple security devices can be orchestrated according to the service orchestration route. Service orchestration can be understood as transmitting service data through these security devices according to the service orchestration route.

[0070] If the above-mentioned service arrangement route is security device 1->security device 2->security device 3, the service data of security device 1 can be transmitted to security device 2, and the service data of security device 2 can be transmitted to security device 3, so that service interaction among the three security devices can be realized.

[0071] It can be understood that in this solution, the security devices registered on the cloud can be linked with other security devices or cloud resources on the cloud to achieve customization of local security services. For example, the sample files of the local firewall can be connected to the malicious file detection system on the cloud or the malicious file detection system registered locally on the cloud, and the result data can be sent back to the firewall. This process can be customized according to the orchestration.

[0072] In some embodiments, the communication channels between the security device and the cloud, and between the security devices, may follow the relevant specifications of the MQTT protocol, which is a "lightweight" message protocol based on the publish / subscribe paradigm and built on the TCP / IP protocol. Based on the MQTT protocol, the specifications for security device access can be implemented, describing the transmission data format, MQTT Topic (MQTT subscription / publishing topic) specifications, etc.

[0073] The MQTT protocol uses TLS / SSL security protocol encryption. It uses encryption algorithms to protect network communications from eavesdropping and tampering, ensuring the security of data transmission. Therefore, the data interaction between intranet security devices and the cloud follows the security specifications of the MQTT protocol.

[0074] In addition, in the MQTT protocol, the intranet security device and the cloud 13 can also use certificates for two-way authentication to ensure the credibility of the intranet security device. Both parties have a pair of public and private keys. When establishing a connection, the two parties exchange certificates and verify each other's certificates to ensure that both parties in the communication are authenticated and trusted entities.

[0075] The data transmission service quality in the MQTT protocol is QoS2, which ensures the reliability of data transmission.

[0076] The data transmitted by the communication channel based on the MQTT protocol can be transmitted in the Protocol Buffers (v3) data format, which effectively reduces the transmission volume (90% space is saved compared to JSON and binary after serialization), and the structural platform independence is applicable.

[0077] Among them, the relevant specifications of the MQTT protocol include at least one of the following: device access specifications, device file transfer specifications, log file transfer specifications, custom data transmission specifications, instruction issuance specifications, device basic information reporting specifications, device authorization information specifications, rule base upgrade specifications, and inter-device communication specifications. By defining these specifications, the communication between the intranet security devices and the cloud is constrained, thereby improving the security of communication.

[0078] (1) Device access specifications, including MQTT topic naming, structured data sent by device registration, and structured data indicating successful or failed access.

[0079] (2) Device file transfer specifications, including MQTT topic naming, file segmentation specifications, file upload or download specifications, etc.

[0080] (3) Log file transmission specifications, including MQTT Topic naming, log compression upload specifications, log single record specifications, log structure compliance with Syslog, etc.

[0081] (4) Customized data transmission specifications, involving MQTT Topic naming, are divided into asynchronous data transmission structure specifications and synchronous request and response data structure specifications.

[0082] (5) Instruction issuance specifications, including MQTT Topic naming, instruction data structure specifications, and instruction execution response data structure.

[0083] (6) Specifications for reporting basic device information, including MQTT Topic naming, basic information data structure specifications, heartbeat data structure specifications, etc.

[0084] (7) Device authorization information specifications, including MQTT topic naming, authorization basic information reporting specifications, and authorization file download specifications.

[0085] (8) Rule base upgrade specifications, including MQTT topic naming, checking whether the rule base has been upgraded, and rule base file downloading.

[0086] (9) Inter-device communication specifications, including MQTT topic naming, inter-device request structure (including synchronous and asynchronous transmission methods), device discovery, and other specifications.

[0087] The specific implementation of the above-mentioned specifications can be flexibly set according to the actual situation. After formulating these relevant specifications, the MQTT protocol can be deployed for data communication. In this way, there is no need to make additional settings for the relevant requirements of data communication. You only need to communicate according to the relevant specifications of the above-mentioned MQTT protocol.

[0088] It should be noted that if the security device needs to interact with cloud resources, the business orchestration route can also include the cloud, and the cloud can also be configured with corresponding data input rules and data output rules, so that the security device can use cloud resources to process business. Cloud resources are a collection of security business systems managed by the cloud, which provide security capabilities for security devices, such as cloud malicious sample analysis systems, cloud threat intelligence systems, etc. These systems also use the MQTT protocol to register with the cloud, and corresponding data input rules and data output rules can be configured for each cloud resource, so that the security device can only interact with a certain cloud resource for business data. These cloud resources are uniformly managed by the cloud and are public to users.

[0089] The overall architecture flow chart of this solution can be shown as follows Figure 2 As shown, first, the local security device can be registered in the cloud, and the cloud can build a local device resource pool based on the registered local security device. Then the cloud can perform business orchestration in combination with the device linkage rule library. During the business orchestration process, the device linkage rule library, local security devices and cloud resources can be used in combination with their own security business scenarios to customize the business orchestration process. After the orchestration, an orchestration configuration will be formed, including information such as business orchestration route identification. The configuration will be sent to specific security devices and cloud resources based on the MQTT protocol. For example, the sample file of the local firewall can be connected to the malicious file detection system on the cloud or the malicious file detection system registered locally by the user on the cloud by dragging and dropping, and the result data is transmitted back to the firewall device, where the file sample output is an output rule, and the malicious file detection system on the cloud receives an input rule, and the output rule and the input rule can correspond.

[0090] After business orchestration, the cloud can also provide orchestration management functions, mainly involving node start and stop, node monitoring, and data auditing. It provides a visual management interface to facilitate users to adjust and audit the orchestration process, making business orchestration simpler and able to respond to different security business scenarios at any time.

[0091] In the above implementation process, the cloud determines the business orchestration routes of multiple security devices according to the data input rules and data output rules configured for each security device, and orchestrates the business of multiple security devices according to the business orchestration routes. In this way, business orchestration can be implemented by utilizing cloud resources to meet the needs of different business scenarios.

[0092] Based on the above embodiment, in the above method of determining the business orchestration routes of multiple security devices, the correspondence between data input rules and data output rules can be first queried from the device linkage rule library, and then the business orchestration routes of multiple security devices can be determined based on the correspondence.

[0093] As mentioned above, a large number of data input rules and data output rules are stored in the device linkage rule library, and the data input rules and data output rules have a corresponding relationship. After determining the multiple security devices that need to be orchestrated, the data input rules and data output rules of the multiple security devices can be obtained, and then the corresponding relationship between the data input rules and data output rules can be found from the device linkage rule library, so that the service orchestration routes of the multiple security devices can be determined according to the corresponding relationship.

[0094] Specifically, according to the corresponding relationship, the security devices corresponding to the data input rules and data output rules having the corresponding relationship can be arranged to form a business arrangement route.

[0095] For example, security device 1 is configured with data input rule 1 and data output rule 1, security device 2 is configured with data input rule 2 and data output rule 2, and security device 3 is configured with data input rule 3 and data output rule 1. In the device linkage rule library, data output rule 1 corresponds to data input rule 2, and data output rule 2 corresponds to data input rule 3. According to this correspondence, the business orchestration route can be determined as security device 1->security device 2->security device 3->security device 2. Here, security device 2 and security device 3 can interact with each other for business data.

[0096] In the above implementation process, by building a device linkage rule library, the business interactions between various security devices can be conveniently constrained according to the correspondence between data input rules and data output rules in the device linkage rule library, and business orchestration can be quickly implemented according to the correspondence.

[0097] On the basis of the above embodiment, after performing service orchestration on multiple security devices, the cloud can also transmit service data between the multiple security devices according to the service orchestration route.

[0098] After determining the business orchestration route, the cloud saves the business orchestration route and assigns a unique identifier to the business orchestration route, recorded as the business orchestration route identifier, and binds the business orchestration route identifier with the device information of each security device on the business orchestration route, such as binding the business orchestration route identifier with the device identifier of each security device.

[0099] In this way, when security devices are interacting with each other, the business data transmitted by a certain security device will be transmitted to the cloud first. After the cloud receives the business data, it will find the corresponding business orchestration route identifier based on the device identifier of the security device, and then determine the corresponding business orchestration route and find the next security device on the business orchestration route. In this way, the business data can be transmitted to the next security device, thereby realizing the transmission of business data on the business orchestration route.

[0100] In the above implementation process, business communication between local intranet devices can be realized, so that security devices can use the resources of other security devices to process business, solving the problem of limited business capabilities of a single local device.

[0101] On the basis of the above embodiment, in order to ensure the security of data transmission, when transmitting business data, the cloud receives business data and other information sent by the security device, the other information includes the representation of the data output rule and the business orchestration route identifier, and then queries the output rule validator corresponding to the data output rule according to the representation of the data output rule, and then uses the output rule validator to verify the business data. After the verification is passed, the corresponding business orchestration route is queried according to the business orchestration route identifier, and the business data is sent to the next security device in the business orchestration route.

[0102] Among them, in the device linkage rule library, corresponding rule validators are configured for each data input rule and each data output rule. Each rule can correspond to a rule validator. The rule validator is mainly used to verify the data standardization, legality, threat, etc. of business data such as input data and output data. For example, the data input rule represents the relevant requirements for data input, then the validator corresponding to the data input rule is used to verify the input data according to the relevant requirements corresponding to the input rule; the data output rule represents the relevant requirements for data output, then the validator corresponding to the data output rule is used to verify the output data according to the relevant requirements corresponding to the output rule.

[0103] The cloud receives the business data from the security device. For the cloud, the business data is input, but for the security device, the business data is output, so the cloud can use the output rule validator to verify the business data, and the cloud can also use the rule validator corresponding to the cloud data input rule to verify the business data. Of course, when the security device outputs the business data, the security device itself can use the output rule validator to verify it. After the verification is passed, the security device will output the business data.

[0104] In order to simplify the verification process, the cloud can verify the received business data according to the output rule validator, and the cloud will send the business data to the security device. The security device that receives the business data can use the input rule validator to verify. In this case, both the cloud and the security device are configured with a device linkage rule library, so that after the cloud receives the business data, it can find the data rule validator corresponding to the identifier of the data output rule in the device linkage rule library according to the identifier of the data output rule. When the cloud sends business data to the security device, it will also carry the identifier of the data input rule and the business orchestration route identifier, so that the security device can find the input rule validator corresponding to the identifier of the data input rule from the device linkage rule library to verify the input requirements of the received business data, and then find the next device according to the business orchestration route identifier and forward the business data.

[0105] In some implementations, when the security device initiates business data, it forwards the business data to the cloud and also sends data such as basic device information simultaneously. After the cloud receives the business data, it verifies the business data through the output rule validator to ensure the security of data transmission, records the data that fails the verification, and forwards the data that passes the verification to the next device. After the next security device or cloud resource receives the business data, it verifies the received business data using the input rule validator. If the verification is successful, the business data is processed accordingly. If the verification fails, the data is discarded. The specific implementation process can be as follows: Figure 3 shown.

[0106] In the above implementation process, an output rule validator is provided corresponding to the data output rule, so that the cloud verifies the received business data using the output rule validator, thereby ensuring the security of data transmission.

[0107] On the basis of the above embodiment, in order to facilitate the service arrangement of each security device, in the specific arrangement method, in response to the operation of opening the arrangement interface, the security device list registered on the cloud can be loaded and displayed, and the security device list includes multiple security devices. Then, in response to the drag operation of the security device, the dragged security device is displayed in the arrangement area, and the multiple security devices in the arrangement area are determined as multiple security devices to be arranged. The specific arrangement implementation process can be as follows: Figure 4 shown.

[0108] For example, the cloud can provide users with an orchestration interface, in which users can select security devices that need to be orchestrated according to business needs. Users can open the orchestration interface in the cloud, and after the cloud detects the operation, it can display a list of security devices registered on the cloud to display multiple registered security devices to the user.

[0109] Since the device linkage rule library is configured with the correspondence between each data input rule and data output rule, as well as the correspondence with the security device, the security device or cloud resource for docking input or output can be matched according to the information of the device linkage rule library and the security device. Then the user can select the corresponding security device or cloud resource for orchestration according to business needs.

[0110] The user can select a security device in the security device list, and then drag the icon or other logo of the security device into the orchestration area. At this time, the cloud can display the dragged security device in the orchestration area, and the security device in the orchestration area is considered to be the security device that the user wants to orchestrate.

[0111] The cloud can also provide a rule configuration function for security devices to be orchestrated. That is, after dragging the security devices to the orchestration area, users can also reconfigure new data input rules and data output rules for these security devices, or perform corresponding parameter configurations on the data input rules and data output rules for these security devices. For example, if the threat intelligence platform is selected to output the threat intelligence library for the local security device, the threat intelligence library synchronization period, synchronization data type (IP reputation, domain name reputation), etc. can be configured according to the parameter rules.

[0112] If the user needs to continue adding security devices to the orchestration, the user can continue to drag security devices from the security device list to the orchestration area.

[0113] The cloud can determine the corresponding business orchestration routes for multiple security devices to be orchestrated. The cloud saves these configurations and sends the configured business orchestration routes to the orchestrated security devices or cloud resources through the MQTT protocol. To ensure the security of the MQTT channel, the cloud will develop the MQTT Topic subscription and publishing permissions required by the data input rules and data output rules in the configuration to the specified security device. After receiving the linkage configuration, the security device starts the business function according to the configuration of the data input rules and data output rules, and subscribes to the Topic opened by the cloud MQTT.

[0114] When business data is interacting, the security device transmits the business data to the cloud, which is responsible for coordinating and forwarding the business data to ensure that the data flow follows the business orchestration route customized by the user.

[0115] In the above implementation process, the security device to be arranged can be selected by dragging the security device, which is convenient for user operation and improves the arrangement efficiency.

[0116] On the basis of the above embodiments, in the method of determining the business orchestration routes of multiple security devices, since a security device may be configured with multiple data input rules and data output rules, there may be multiple business orchestration situations between multiple security devices. If the user is not familiar with the business requirements, it is necessary to query a large amount of information to orchestrate each security device. In order to improve the orchestration efficiency, the cloud can generate multiple candidate business orchestration routes for multiple security devices based on the data input rules and data output rules configured for multiple security devices in the orchestration area. In response to the selection operation of multiple candidate business orchestration routes, the selected candidate business orchestration route is determined as the business orchestration route for multiple security devices.

[0117] That is, the cloud can obtain the correspondence between the data input rules and data output rules of multiple security devices from the device linkage rule library, and then generate multiple candidate business orchestration routes based on these correspondences. The cloud can also perform business identification on each candidate business orchestration route to indicate what kind of business interaction each business orchestration route can perform. In this way, users can select from multiple candidate business orchestration routes according to business needs, and determine the selected candidate business orchestration route as the business orchestration route for multiple security devices.

[0118] In some embodiments, after selecting multiple security devices that need to be orchestrated, the user can select data input rules and data output rules for each security device according to business needs. In this way, the cloud can also generate corresponding business orchestration routes based on these data input rules and data output rules. At this time, there may be multiple business orchestration routes generated. In the case of multiple cases, the transmission of business data can go through multiple business orchestration routes. When forwarding business data, the cloud also forwards the business data to different devices according to the multiple business orchestration routes.

[0119] In the above implementation process, the cloud generates multiple candidate business orchestration routes based on data input rules and data output rules. Users only need to choose from them according to business needs, which can simplify user operations and improve orchestration efficiency.

[0120] On the basis of the above embodiments, in other implementation methods of determining the business orchestration route, orchestration can also be performed through user operations. The cloud responds to the connection operation of the security device, and then determines the interconnected security devices, obtains the data input rules and data output rules configured for the interconnected security devices, verifies the matching of the data input rules of the interconnected first security device and the data output rules of the second security device, and after the verification is passed, determines the business orchestration route of the interconnected first security device and the second security device.

[0121] That is, the user can connect the security devices that need to be orchestrated in the orchestration area. For example, if the user wants to orchestrate security device 1 and security device 2, the user can connect security device 1 and security device 2 in the orchestration area. After the cloud detects the connection operation, it can obtain the data input rules and data output rules configured for security device 1 and security device 2, and then determine whether the data output rules of security device 1 (i.e., the first security device) and the data input rules of security device 2 (i.e., the second security device) match. The matching verification can be to search the device linkage rule library to see whether the data output rules and data input rules have a corresponding relationship. If so, the verification passes, and if not, the verification fails.

[0122] For those that fail the verification, the cloud can output a prompt message and disconnect the connection between the security devices. The user can reconnect the security device according to the prompt message, or reconfigure new data input rules and data output rules for the connected security device, so that the data input rules and data output rules correspond. For those that pass the verification, the cloud can also output a prompt message that the verification has passed, indicating that the two security devices can be orchestrated, so that the interconnected security devices can form a business orchestration route.

[0123] In the above implementation process, the user connects the security device that needs to be orchestrated, and the cloud verifies the connected security device according to the data input rules and data output rules to determine whether it can perform business orchestration, thereby ensuring the accuracy of business orchestration.

[0124] The following is a specific example. Figure 5 shown.

[0125] There are intranet A and intranet B locally. The two networks are physically isolated and cannot communicate with each other. The firewall in intranet A cannot use the malicious file detection system in intranet B (the malicious file detection system is on the security device of intranet B). There are four rules configured in the device linkage rule base, namely output 1 (output threat intelligence), input 1 (receive threat intelligence), output 2 (output sample file), and input 2 (receive sample file). There is a corresponding relationship between input 1 and output 1, and there is a corresponding relationship between input 2 and output 2. The firewall is configured with input 1 and output 2, the threat intelligence system is configured with output 1, and the malicious file detection system is configured with input 2.

[0126] First, the firewall, local malicious file detection system, and threat intelligence system are all registered to the cloud using the MQTT protocol. The firewall and local malicious sample detection system can be viewed in the local security device, and the threat intelligence system can be viewed in the cloud resource pool.

[0127] The user logs in to the cloud, orchestrates the security devices through the security service orchestration, selects the firewall, and based on the relevant configuration of the device linkage rule base, can orchestrate the business route from the cloud threat intelligence system to the firewall to input threat intelligence, and can also orchestrate the business route from the firewall to the local malicious file detection system. After the user's orchestration is completed, the cloud can send the linkage configuration to each security device and cloud resources. At this point, the user's firewall can enjoy the cloud threat intelligence subscription service and open up the communication between the two physically isolated security devices.

[0128] Please refer to Figure 6 , Figure 6 This is a structural block diagram of a service arrangement device 200 provided in an embodiment of the present application. The device 200 may be a module, program segment or code on an electronic device (such as a cloud). It should be understood that the device 200 is similar to the above Figure 1 The method embodiment corresponds to and can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device 200 can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0129] Optionally, the device 200 includes:

[0130] A device determination module 210, configured to determine a plurality of security devices to be orchestrated, wherein the plurality of security devices are local devices registered on the cloud;

[0131] An orchestration route determination module 220, configured to determine a service orchestration route of the plurality of security devices according to data input rules and data output rules configured on each security device;

[0132] The orchestration module 230 is configured to perform service orchestration on the multiple security devices according to the service orchestration route.

[0133] Optionally, the orchestration route determination module 220 is used to query the correspondence between the data input rules and the data output rules from the device linkage rule library; according to the correspondence, the security devices corresponding to the data input rules and data output rules with the corresponding relationship are orchestrated to form a business orchestration route.

[0134] Optionally, the device 200 further includes:

[0135] A data transmission module is used to transmit the business data between the multiple security devices according to the business arrangement route.

[0136] Optionally, the data transmission module is used to receive business data and other information sent by a security device, wherein the other information includes an identifier of a data output rule and a business orchestration route identifier; query an output rule validator corresponding to the data output rule according to the identifier of the data output rule; verify the business data using the output rule validator; after the verification is passed, query the corresponding business orchestration route according to the business orchestration route identifier, and send the business data to the next security device in the business orchestration route.

[0137] Optionally, the device determination module 210 is used to load and display a list of security devices registered on the cloud in response to an operation of opening the orchestration interface, wherein the list of security devices includes multiple security devices; in response to a drag operation on a security device, the dragged security device is displayed in the orchestration area, and the multiple security devices in the orchestration area are determined as multiple security devices to be orchestrated.

[0138] Optionally, the orchestration route determination module 220 is used to generate multiple candidate business orchestration routes for the multiple security devices according to data input rules and data output rules configured for the multiple security devices in the orchestration area; in response to a selection operation of the multiple candidate business orchestration routes, determine the selected candidate business orchestration route as the business orchestration route for the multiple security devices.

[0139] Optionally, the orchestration route determination module 220 is used to determine the interconnected security devices in response to the connection operation of the security devices; obtain the data input rules and data output rules configured for the interconnected security devices; verify the matching of the data output rules of the first security device and the data input rules of the second security device connected to each other; and after the verification is passed, determine the business orchestration route of the first security device and the second security device connected to each other.

[0140] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0141] Please refer to Figure 7 , Figure 7A structural diagram of an electronic device for executing a service orchestration method provided in an embodiment of the present application, the electronic device may include: at least one processor 310, such as a CPU, at least one communication interface 320, at least one memory 330 and at least one communication bus 340. Among them, the communication bus 340 is used to realize the connection communication between these components. Among them, the communication interface 320 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The memory 330 can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 330 can optionally also be at least one storage device located away from the aforementioned processor. The memory 330 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 310, the electronic device executes the above-mentioned Figure 1 The method process is shown.

[0142] Understandably, Figure 7 The structure shown is for illustration only, and the electronic device may also include Figure 7 More or fewer components as shown, or with Figure 7 Different configurations shown. Figure 7 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0143] The present application embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the following is performed: Figure 1 The method process in the method embodiment shown is executed by the electronic device.

[0144] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can perform the methods provided by the above method embodiments, for example, including:

[0145] Determining a plurality of security devices to be orchestrated, wherein the plurality of security devices are local devices registered on the cloud;

[0146] Determining the service arrangement routes of the plurality of security devices according to the data input rules and data output rules configured for each security device;

[0147] The multiple security devices are service orchestrated according to the service orchestration route.

[0148] In summary, the embodiments of the present application provide a business orchestration method, an electronic device, a storage medium, and a program product, which determine the business orchestration routes of multiple security devices through the cloud according to the data input rules and data output rules configured for each security device, and perform business orchestration on multiple security devices according to the business orchestration routes. In this way, business orchestration can be implemented by utilizing cloud resources to meet the needs of different business scenarios.

[0149] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0150] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0152] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0153] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A service arrangement method, characterized in that: Applied to the cloud, the method includes: Determining a plurality of security devices to be orchestrated, wherein the plurality of security devices are local devices registered on the cloud; Determining the service arrangement routes of the plurality of security devices according to the data input rules and data output rules configured for each security device; The multiple security devices are service orchestrated according to the service orchestration route.

2. The method according to claim 1, characterized in that The determining the service arrangement routes of the plurality of security devices according to the data input rules and data output rules configured on each security device includes: Querying the corresponding relationship between the data input rule and the data output rule from the device linkage rule library; According to the corresponding relationship, the security devices corresponding to the data input rules and data output rules having the corresponding relationship are arranged to form a service arrangement route.

3. The method according to claim 1, characterized in that After performing service arrangement on the plurality of security devices according to the service arrangement route, the method further includes: The service data between the multiple security devices is transmitted according to the service orchestration route.

4. The method according to claim 1, characterized in that: The transmitting the service data between the plurality of security devices according to the service arrangement route includes: Receiving business data and other information sent by the security device, wherein the other information includes an identifier of a data output rule and an identifier of a business arrangement route; Querying an output rule validator corresponding to the data output rule according to the identifier of the data output rule; Verifying the business data using the output rule verifier; After the verification is passed, the corresponding service arrangement route is queried according to the service arrangement route identifier, and the service data is sent to the next security device in the service arrangement route.

5. The method according to claim 1, characterized in that: The determining of the plurality of security devices to be arranged comprises: In response to an operation of opening the orchestration interface, loading and displaying a list of security devices registered on the cloud, the list of security devices including a plurality of security devices; In response to a drag operation on a safety device, the dragged safety device is displayed in a layout area, and a plurality of safety devices in the layout area are determined as a plurality of safety devices to be arranged.

6. The method according to claim 5, characterized in that The determining the service arrangement routes of the plurality of security devices according to the data input rules and data output rules configured on each security device includes: generating a plurality of candidate service orchestration routes for the plurality of security devices according to data input rules and data output rules configured for the plurality of security devices within the orchestration area; In response to a selection operation of the plurality of candidate service orchestration routes, the selected candidate service orchestration routes are determined as service orchestration routes of the plurality of security devices.

7. The method according to claim 1, characterized in that The determining the service arrangement routes of the plurality of security devices according to the data input rules and data output rules configured on each security device includes: In response to a connection operation of the security devices, determining the security devices connected to each other; Obtain data input rules and data output rules configured for interconnected security devices; Verifying the matching of a data output rule of a first security device and a data input rule of a second security device connected to each other; After the verification is passed, a service orchestration route of the first security device and the second security device connected to each other is determined.

8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is executed.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is performed.

10. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images