Security protection method combining SRv6 SFC technology and security resource pool

Abstract

The embodiment of the invention discloses a security protection method combining an SRv6 SFC technology and a security resource pool, and relates to the technical field of network service security, and the method comprises the steps: obtaining a target network service protection function demand and a data transmission node; selecting a target protection component in a preset security resource pool according to the protection function requirement, and performing SFC arrangement on the target protection component through a virtualized arrangement network to generate a security function forwarding node; and constructing an SFC service function chain of the SRv6 network according to the data transmission node and the security function forwarding node, and transmitting service data of the target network service according to the SRv6 network through the SRv6 technology. The SRv6 SFC technology is combined with the security resource pool, so that the security protection function can be flexibly adjusted when a service data transmission path is planned, and targeted protection is performed on different service data.

Description

Technical Field

[0001] The present invention relates to the field of network service security technology, and in particular to a security protection method combining SRv6 SFC technology with a security resource pool. Background Art

[0002] At present, most of the network security protection is provided through SF (Service Function) service nodes, which include but are not limited to firewalls (FW), intrusion prevention systems (IPS), load balancing (LB) devices, and address translation (NAT) devices, etc., to meet the needs of network security protection. However, multiple service nodes use different security devices, and the combination of security devices used is fixed, while network services are diverse. It is obvious that a single combination of security devices cannot meet the needs of all network services. When the security device combination is built with the highest demand, it will cause a waste of security devices when facing low-demand services. When the security device combination is built with the average demand, it will cause a waste of security devices when facing low-demand services, and it will not meet the needs of high-demand network services. At the same time, there is a defect that it is not easy to uniformly manage and operate. This defect is particularly obvious in the industry scenario, where multiple types and numbers of security protection nodes are required to be uniformly managed and operated.

[0003] In the prior art, there are security protection methods based on network virtualization technology. However, in the process of security protection, the existing methods rely on the query of routing tables and the tunnel encapsulation and decapsulation operations of additional protocols. When faced with large-scale network expansion and complex security requirements, they require major architectural adjustments and resource investments. They cannot adapt to the rapidly changing network environment and have limitations. Summary of the invention

[0004] In view of this, the present invention provides a security protection method combining SRv6 SFC technology with a security resource pool, which is used to solve the problems of lack of pertinence in security protection of network services and lack of unified management of security devices in the prior art.

[0005] In a first aspect, an embodiment of the present invention provides a security protection method combining SRv6 SFC technology with a security resource pool, the method comprising: Obtain the protection function requirements, data transmission nodes and data flow information of the target network business; Select a target protection component in a preset security resource pool according to the protection function requirement, and perform SFC orchestration on the target protection component through a virtualized orchestration network to generate a security function forwarding node; By using SRv6 technology, a service function chain of SRv6 SFC is constructed according to the data flow information, the data transmission node and the security function forwarding node, and the service data of the target network service is transmitted according to the service function chain of SRv6 SFC; The step of transmitting the service data of the target network service according to the service function chain of the SRv6 SFC comprises: Adding the path information of the SRv6 TE Policy to the original IPv6 message of the service data at the head node of the SRv6 network, and adding an SRH extension header to the original IPv6 message to obtain a new message, wherein the SRH extension header stores the Segment List information; Controlling the service data and the new message to pass through the next node of the head node according to the path information; When the next node of the head node corresponds to the security function forwarding node, controlling the security function forwarding node to match the destination IPv6 address; If the new message hits the local SID of the security function forwarding node, the action corresponding to the local SID is executed on the service data to obtain the target service data, and the target service data is forwarded according to the path information; the attribute data is matched with the in-tunnel detection strategy, and if the match is successful, the service data is sent to the in-tunnel detection module for protection detection; If the new message does not hit the local SID of the security function forwarding node, extract the attribute data of the new message and match the attribute data with the detection policy in the tunnel; if the match fails, forward the service data and the new message according to the path information; Decapsulating the service data and the new message after matching the in-tunnel detection strategy to obtain the IPv6 message without the SRH extension header, and identifying the message type of the IPv6 message without the SRH extension header; if the message type of the IPv6 message without the SRH extension header is still a tunnel message, continuing to decapsulate the IPv6 message with the SRH extension header until the service message is obtained; If the new message hits the local SID of the security function forwarding node, the step of performing an action corresponding to the local SID on the service data to obtain the target service data includes: Sending the service data to a first target protection component corresponding to the local SID in the security function forwarding node, so that the first target protection component performs an action corresponding to the local SID on the service data to obtain primary service data; The primary business data is sent to the security function forwarding node, and the primary business data is sent to the second target protection component corresponding to the local SID in the security function forwarding node, so that the second target protection component executes the action corresponding to the local SID on the primary business data to obtain secondary business data, until the last target protection component in the security function forwarding node completes the security protection of the business data and obtains the target business data.

[0006] Optionally, the step of obtaining the protection function requirement of the target network service includes: Determine the data transmission node and the data transmission relationship between different data transmission nodes according to the data flow information; Determine basic protection requirement data between different data transmission nodes based on the data transmission relationship; The user's preset protection requirement data for different data transmission nodes is obtained, and the preset protection requirement data and the basic protection requirement data are integrated to obtain the protection function requirements between different data transmission nodes.

[0007] Optionally, before the step of selecting a target protection component in a preset security resource pool according to the protection function requirement, the method further includes: Decoupling the preset protection components through the Openstack architecture to obtain underlying protection component resources corresponding to the preset protection components, wherein the preset protection components include physical network security devices and virtual network security devices; Constructing a resource management platform for managing the resources of the underlying protection components by means of software programming; The preset security resource pool is built based on the resource management platform and the underlying protection component resources.

[0008] Optionally, the step of selecting a target protection component in a preset security resource pool according to the protection function requirement, and performing SFC orchestration on the target protection component through a virtualized orchestration network to generate a security function forwarding node includes: Selecting a preset component that can meet the protection function requirements in a preset security resource pool as the target protection component; Creating an SFC for the target network service based on the target protection component and a logical sequence between different target protection components, wherein the logical sequence is determined according to functions of the target protection components; Through the virtualized orchestration network, the target protection components are orchestrated according to the SFC, and a security function forwarding node including at least one target protection component is generated, so that the business data flows through each target protection component in the logical order.

[0009] Optionally, the step of building a service function chain of an SRv6 SFC according to the data flow information, the data transmission node, and the security function forwarding node by using the SRv6 technology includes: According to the data flow information, the address of the data transmission node and the address of the security function forwarding node are connected to obtain different network segments; According to the preset protocol, each network segment route is made reachable through the preset route, and the preset route and the network orchestrator are SRv6 SID planned through the SRv6 technology to obtain the planned preset route and the planned security function forwarding node, so that the planned preset route and the planned security function forwarding node support the SRv6 SFC function; Dynamically announce the SRv6Locator route in the planned security function forwarding node through IGP; The TE-Policy of the SRv6Locator route is configured according to the data flow information, and the service function chain of the SRv6 SFC is constructed.

[0010] Optionally, the step of transmitting the service data of the target network service according to the service function chain of the SRv6 SFC includes: Adding the path information of the SRv6 TE Policy to the original IPv6 message of the service data at the head node of the SRv6 network, and adding an SRH extension header to the original IPv6 message to obtain a new message, wherein the SRH extension header stores the Segment List information; Controlling the service data and the new message to pass through the next node of the head node according to the path information; When the next node of the head node corresponds to the security function forwarding node, controlling the security function forwarding node to match the destination IPv6 address; If the new message hits the local SID of the security function forwarding node, the action corresponding to the local SID is executed on the service data to obtain the target service data, and the target service data is forwarded according to the path information; the attribute data is matched with the in-tunnel detection strategy, and if the match is successful, the service data is sent to the in-tunnel detection module for protection detection; If the new message does not hit the local SID of the security function forwarding node, extract the attribute data of the new message and match the attribute data with the detection policy in the tunnel; if the match fails, forward the service data and the new message according to the path information; The service data and the new message that are matched with the detection strategy within the tunnel are decapsulated to obtain the IPv6 message without the SRH extension header, and the message type of the IPv6 message without the SRH extension header is identified; if the message type of the IPv6 message without the SRH extension header is still a tunnel message, the IPv6 message with the SRH extension header is continued to be decapsulated until the service message is obtained.

[0011] Optionally, if the new message hits the local SID of the security function forwarding node, the step of performing an action corresponding to the local SID on the service data to obtain the target service data includes: Sending the service data to a first target protection component corresponding to the local SID in the security function forwarding node, so that the first target protection component performs an action corresponding to the local SID on the service data to obtain primary service data; The primary business data is sent to the security function forwarding node, and the primary business data is sent to the second target protection component corresponding to the local SID in the security function forwarding node, so that the second target protection component executes the action corresponding to the local SID on the primary business data to obtain secondary business data, until the last target protection component in the security function forwarding node completes the security protection of the business data and obtains the target business data.

[0012] In a second aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising: One or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a security protection method combining the SRv6 SFC technology and the security resource pool as described in any embodiment of the present invention.

[0013] In a third aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute a security protection method combining the SRv6SFC technology with a security resource pool as described in any embodiment of the present invention.

[0014] The technical solution of the embodiment of the present invention, by combining SRv6 SFC technology with the security resource pool, can flexibly adjust the security protection function when planning the business data transmission path, and carry out targeted protection for different business data. At the same time, the unique advantages of SRv6 technology in network programmability and flexibility do not rely on the tunnel encapsulation of additional protocols when performing data transmission, and have better adaptability, flexibility and scalability for large-scale network scenarios. The security resource pool can uniformly manage different security components, and at the same time, it can also flexibly build different security component combinations according to different needs, that is, build a security component combination for specific network services, save costs while meeting the needs of network services, and specifically, according to the actual network security needs, allocate security components to the most needed network services, improve resource utilization, and more quickly meet the needs of network service security through the security resource pool. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] in: Figure 1 A schematic diagram of a flow chart of a security protection method combining SRv6 SFC technology with a security resource pool in one embodiment; Figure 2 This is an operation scenario diagram of a security protection method combining SRv6 SFC technology with a security resource pool in one embodiment; Figure 3 A schematic diagram of the operation of a security resource pool in a security protection method combining an SRv6 SFC technology with a security resource pool in one embodiment; Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application; Figure 5 It is a structural schematic diagram of a computer-readable storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] In one embodiment, an embodiment of the present invention provides a security protection method combining SRv6 SFC technology with a security resource pool, and the security protection method combining SRv6 SFC technology with a security resource pool in the embodiment of the present invention can be executed by a security protection device combining SRv6 SFC technology with a security resource pool. The security protection device combining SRv6 SFC technology with a security resource pool can be implemented by software and / or hardware.

[0019] like Figure 1 As shown, the security protection method combining the SRv6 SFC technology and the security resource pool in the embodiment of the present invention specifically includes the following steps: S110, obtaining protection function requirements, data transmission nodes and data flow information of target network services; In a possible implementation manner, the step of obtaining the protection function requirement of the target network service includes: Determine the data transmission node and the data transmission relationship between different data transmission nodes according to the data flow information; Determine basic protection requirement data between different data transmission nodes based on the data transmission relationship; The user's preset protection requirement data for different data transmission nodes is obtained, and the preset protection requirement data and the basic protection requirement data are integrated to obtain the protection function requirements between different data transmission nodes.

[0020] Exemplarily, the data flow information represents the data flow information during the execution of the target network service. For example, during the execution of the target network service, the data flow flows from end A to end B, and then from end B to end C. Then end A, end B, and end C are data transmission nodes, and the data transmission relationship between different data transmission nodes is from end A to end B, and from end B to end C.

[0021] For example, due to differences in data transmission nodes, the basic protection requirement data between different data transmission nodes are also different. Therefore, it is necessary to determine the basic protection requirement data between different data transmission nodes based on the actual data transmission relationship (for example, from server to client, from server to server).

[0022] For example, in actual applications, users will also set security protection requirements between different data transmission nodes according to actual needs. For example, they pay to purchase different types of security components and use the purchased security components between specific data transmission nodes. Therefore, the preset protection requirement data and the basic protection requirement data are integrated to obtain the protection requirement data between different data transmission nodes to ensure user needs.

[0023] S120, selecting a target protection component in a preset security resource pool according to the protection function requirement, and performing SFC orchestration on the target protection component through a virtualized orchestration network to generate a security function forwarding node; In a possible implementation, the step of selecting a target protection component in a preset security resource pool according to the protection function requirement, and performing SFC orchestration on the target protection component through a virtualized orchestration network to generate a security function forwarding node includes: Selecting a preset component that can meet the protection function requirements in a preset security resource pool as the target protection component; Creating an SFC for the target network service based on the target protection component and a logical sequence between different target protection components, wherein the logical sequence is determined according to functions of the target protection components; Through the virtualized orchestration network, the target protection components are orchestrated according to the SFC, and a security function forwarding node including at least one target protection component is generated, so that the business data flows through each target protection component in the logical order.

[0024] Specifically, the logical order between different target protection components, for example, the security function forwarding node - vICG —vWAF—vIPS, the resource management platform will send the SFC forwarding table to the virtual switch and configure relevant diversion strategies (SFC orchestration is achieved through the virtualized orchestration network) to finely guide the business data to the security service chains of different tenants. The specific process is as follows: the security function forwarding node sends the business data to the virtual switch, and sends the business traffic to the first security component. After the first security component performs security protection, it sends the business traffic to the virtual switch and forwards it to the security function forwarding node. The security function forwarding node sends the business traffic to the second security component in the same way, and so on, until all target security components have completed the security protection of the business data.

[0025] S130. Using SRv6 technology, build a service function chain of SRv6 SFC according to the data flow information, the data transmission node and the security function forwarding node, and transmit the service data of the target network service according to the service function chain of SRv6 SFC.

[0026] By combining SRv6 SFC technology with the security resource pool, it is possible to flexibly adjust security protection functions when planning business data transmission paths, and provide targeted protection for different business data. At the same time, SRv6 technology has unique advantages in network programmability and flexibility. It does not rely on tunnel encapsulation of additional protocols when transmitting data, and has better adaptability, flexibility and scalability for large-scale network scenarios. The security resource pool can manage different security components in a unified manner. At the same time, it can also flexibly build different security component combinations according to different needs, that is, build a security component combination for specific network services, save costs while meeting the needs of network services, and specifically, according to actual network security needs, allocate security components to the most needed network services to improve resource utilization. Through the security resource pool, the needs of network service security can be met more quickly.

[0027] In a possible implementation manner, before the step of selecting a target protection component in a preset security resource pool according to the protection function requirement, the method further includes: Decoupling the preset protection components through the Openstack architecture to obtain underlying protection component resources corresponding to the preset protection components, wherein the preset protection components include physical network security devices and virtual network security devices; Constructing a resource management platform for managing the resources of the underlying protection components by means of software programming; The preset security resource pool is built based on the resource management platform and the underlying protection component resources.

[0028] Exemplarily, the Openstack architecture is used as the underlying support technology for the virtualized resource pool, which decouples the physical and virtual network security devices from their access modes, deployment methods, and implementation functions, and abstracts the underlying security components (underlying protection component resources) in the security resource pool.

[0029] Exemplarily, intelligent and automated business arrangement and management are uniformly performed through software programming to build a resource management platform that implements corresponding security functions. The resource management platform is used for lifecycle management, authorization activation, log collection, and security policies of local security components. The resource management platform also provides system users with functions such as tenant management, order ticket approval, self-service, metering and billing, etc. The resource management platform provides a self-service portal and a system management portal for tenants, which are differentiated according to different login roles.

[0030] Exemplarily, as shown in Table 1, the preset protection components include but are not limited to: host security protection components, firewalls, database audit systems, bastion hosts, Web anti-tampering components, log audit components, network security audit components, intrusion detection cloud probe components, cloud vulnerability scanning components, etc.

[0031] Table 1

[0032] In a possible implementation, the step of building a service function chain of the SRv6 SFC according to the data flow information, the data transmission node, and the security function forwarding node by using the SRv6 technology includes: According to the data flow information, the address of the data transmission node and the address of the security function forwarding node are connected to obtain different network segments; According to the preset protocol, each network segment route is made reachable through the preset route, and the preset route and the network orchestrator are SRv6 SID planned through the SRv6 technology to obtain the planned preset route and the planned security function forwarding node, so that the planned preset route and the planned security function forwarding node support the SRv6 SFC function; Dynamically announce the SRv6Locator route in the planned security function forwarding node through IGP; The TE-Policy of the SRv6Locator route is configured according to the data flow information, and the service function chain of the SRv6 SFC is constructed.

[0033] For example, Figure 2 As shown in the figure, the steps of building the service function chain of SRv6 SFC include: Step 1: Plan the interface addresses of each router.

[0034] R1 interface addresses 100::1 / 64, 200::1 / 64; R2 interface addresses 200::2 / 64, 300::2 / 64; Security function forwarding node interface address eth1 100::2 / 64, eth2 300::1 / 64; R1's eth1 is connected to the security function forwarding node interface address eth1; R2's eth1 is connected to the security function forwarding node interface address eth2; Step 2: Configure basic routing to make the IPv6 network connected. You can use IGP routing to make each network segment reachable. It is recommended to use the IS-IS protocol. Step 3: Plan SRv6 SIDs and enable SRv6 functions on R1, R2, and security function forwarding nodes. R1 configures Locatorfc01:: and configures End.DT4 opcode::1 Safety function forwarding node configuration Locatorfc02:: and configure End.DT4 opcode ::1 R2 configures Locatorfc03:: and configures End.DT4 opcode ::1 Step 4: Configure SID routing. The SRv6Locator routing can be dynamically announced through IGP; Step 5: Configure TE-Policy. Configure TE-Policy on R1 to 22.22.22.0 / 24 via [fc02::1 fc03::1] dev eth1; Configure TE-Policy on R2 to 11.11.11.0 / 24 via [fc02::1 fc01::1] dev eth1.

[0035] In a possible implementation manner, the step of transmitting the service data of the target network service according to the service function chain of the SRv6 SFC includes: Adding the path information of the SRv6 TE Policy to the original IPv6 message of the service data at the head node of the SRv6 network, and adding an SRH extension header to the original IPv6 message to obtain a new message, wherein the SRH extension header stores the Segment List information; Controlling the service data and the new message to pass through the next node of the head node according to the path information; When the next node of the head node corresponds to the security function forwarding node, controlling the security function forwarding node to match the destination IPv6 address; If the new message hits the local SID of the security function forwarding node, the action corresponding to the local SID is executed on the service data to obtain the target service data, and the target service data is forwarded according to the path information; the attribute data is matched with the in-tunnel detection strategy, and if the match is successful, the service data is sent to the in-tunnel detection module for protection detection; If the new message does not hit the local SID of the security function forwarding node, extract the attribute data of the new message and match the attribute data with the detection policy in the tunnel; if the match fails, forward the service data and the new message according to the path information; The service data and the new message that are matched with the detection strategy within the tunnel are decapsulated to obtain the IPv6 message without the SRH extension header, and the message type of the IPv6 message without the SRH extension header is identified; if the message type of the IPv6 message without the SRH extension header is still a tunnel message, the IPv6 message with the SRH extension header is continued to be decapsulated until the service message is obtained.

[0036] Exemplarily, the path information [fc02::1 fc03::1] of the SRv6 TE Policy is added to the original message to guide the message to pass through each service node in sequence along the specified path, where the service node fc02::1 is a security function forwarding node. The path of the source route reaches the security function forwarding node fc02::1. The security function forwarding node acts as an agent of the security resource pool and mainly includes an SRv6 protocol module, an SRv6 tunnel detection policy, and a tunnel decapsulation and encapsulation module. The security function forwarding node matches the destination IPv6 address. If the local SID is hit, the action corresponding to the SID is executed. For example, a specified MAC forwarding table query during Layer 2 communication, or a specified routing table query for Layer 3 communication. Extract the attributes of the message, match the tunnel detection policy, and directly forward the SRv6 traffic that does not hit the policy; for the SRv6 traffic that hits the tunnel detection policy, it is sent to the tunnel detection module for further security protection. The message attributes include the source address, the real destination address (SRv6 extension header segments[0]), the inbound interface security zone, and the outbound interface security zone. Decapsulate the SRv6 message and remove the SRv6 extension header of the IPv6 message. If it is a normal service message, perform security protection on it. If the IPv6 message is still a tunnel message, continue to decapsulate the tunnel until it is decapsulated into a normal service message with a source address of 11.11.11.1 and a destination address of 22.22.22.1.

[0037] For example, an IPv6 packet consists of an IPv6 standard header + an extension header (0 to n) + a payload. In order to implement Segment Routing based on the IPv6 forwarding plane, a new type of IPv6 routing extension header (RH) is added, called the SRH (Segment Routing Header) extension header, which specifies an IPv6 explicit path and stores IPv6 Segment List information.

[0038] The head node adds an SRH extension header to the IPv6 message, and the intermediate nodes can forward it according to the path information contained in the SRH extension header.

[0039] IPv6 Destination Address, the destination address of an IPv6 message, referred to as IPv6 DA. In ordinary IPv6 messages, IPv6 DA is fixed. In SRv6, IPv6 DA only identifies the next node of the current message and is constantly changing.

[0040] The segment list of the SRv6 packet is similar to the MPLS label stack information in SR-MPLS and is generated at the ingress node. SegmentList [n] is the first segment list to be processed on the SRv6 path; Segment List [n-1] is the second; Segment List [1] is the second to last; and Segment List [0] is the first to last.

[0041] <Segment List [0], Segment List [1], ..., Segment List [n-1], SegmentList [n]> The SIDs are sorted in reverse order, and sometimes parentheses are used to write them in ascending order, that is, (Segment List [n], Segment List [n-1], ..., Segment List [1], Segment List [0]).

[0042] In SRv6, every time a packet passes through an SRv6 node, the Segment Left (SL) field is reduced by 1 and the IPv6 DA information is changed. The Segment Left and Segment List fields together determine the IPv6 DA information.

[0043] If the SL value is n, the IPv6 DA value is the value of SID [n].

[0044] If the SL value is n-1, the IPv6 DA value is the value of SID [n-1]. ... If the SL value is 1, the IPv6 DA value is the value of SID [1].

[0046] If the SL value is 0, the IPv6 DA value is the value of SID [0].

[0047] SRv6 Segment is in the form of IPv6 address, and is also commonly referred to as SRv6 SID (Segment Identifier).

[0048] SRv6 TE Policy is a new tunnel diversion technology developed based on SRv6 technology. The SRv6 TE Policy path is represented as a segment list (Segment List) of the specified path, called a Segment ID List. Each SID list is an end-to-end path from the source to the destination, and instructs the devices in the network to follow the specified path instead of the shortest path calculated by the IGP. If a data packet is imported into the SRv6 TE Policy, the SID list is added to the data packet by the headend, and the rest of the network devices execute the instructions embedded in the SID list. The path orchestration of SRv6 Policy can be generated in a variety of ways, mainly including statically specified paths, head node path calculation, and controller path calculation.

[0049] Paths formed by different path calculation methods can be installed in the same SRv6 Policy and reflected as different Candidate Paths. According to the default or manually specified priority, SRv6 Policy will select an available Candidate Path from the available Candidate Paths. This design means that when a service uses SRv6 Policy, it does not need to care about details such as path calculation methods. The service only needs to care about its own network requirements. Details such as path calculation and optimization are encapsulated in SRv6 Policy, simplifying the interaction between services and networks.

[0050] For example, SFC usually refers to a sequence of SF (Service Function) nodes. In order to meet specific business, security and other requirements, a specified service flow is usually required to be processed by a specified SF sequence when forwarding. SFC is based on the forwarding principle of SRv6 TE Policy: SRv6 TE Policy instructs devices in the network to forward packets along the specified path through Segment List, which is very suitable for service chain scenarios. If a data packet is redirected to SRv6 TE Policy, the Segment List of SRv6 TE Policy is added to the data packet by the headend, and the rest of the network devices execute the instructions embedded in the Segment List.

[0051] In a possible implementation manner, if the new message hits the local SID of the security function forwarding node, the step of performing an action corresponding to the local SID on the service data to obtain the target service data includes: Sending the service data to a first target protection component corresponding to the local SID in the security function forwarding node, so that the first target protection component performs an action corresponding to the local SID on the service data to obtain primary service data; The primary business data is sent to the security function forwarding node, and the primary business data is sent to the second target protection component corresponding to the local SID in the security function forwarding node, so that the second target protection component executes the action corresponding to the local SID on the primary business data to obtain secondary business data, until the last target protection component in the security function forwarding node completes the security protection of the business data and obtains the target business data.

[0052] For example, Figure 3 As shown in the figure, SFC orchestration is implemented through a virtualized orchestration network, and relevant diversion strategies are configured to finely guide service traffic to the security service chains of different tenants. The specific process is as follows: the security function forwarding node sends the service data to the virtual switch, and sends the service traffic to the first security component. After the first security component performs security protection, it sends the service traffic to the virtual switch and forwards it to the security function forwarding node. The security function forwarding node sends the service traffic to the second security component in the same way, and so on, until all target security components have completed the security protection of the service data. The security function forwarding node will re-encapsulate the IPv6 message, insert the SRH extension header to restore it to SRv6 traffic, and continue to forward it according to the path information of the SRv6 TE Policy.

[0053] In a possible implementation, the method further includes: Obtaining the working status of each target protection component in the security function forwarding node, and identifying health information of the target protection component based on the working status; If the health information of the target protection component is faulty, the target protection component is removed from the security function forwarding node.

[0054] Exemplarily, the security function forwarding node will enable the loop detection function. When any security component on the service chain fails, the security function forwarding node will skip this security component, while other security components on the service chain will not be affected, ensuring business continuity. Specifically, the health information of the target security component obtained by the loop detection function will be displayed on the resource management platform.

[0055] In another embodiment of the present invention, an electronic device is also provided. Figure 4 A block diagram of an exemplary electronic device 50 suitable for implementing exemplary embodiments of the present invention is shown. Figure 4 The electronic device 50 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0056] like Figure 4As shown, the electronic device 50 is in the form of a general-purpose computing device. The components of the electronic device 50 may include, but are not limited to: one or more processors or processing units 501, a system memory 502, and a bus 503 connecting different system components (including the system memory 502 and the processing unit 501).

[0057] Bus 503 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0058] The electronic device 50 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 50, including volatile and non-volatile media, removable and non-removable media.

[0059] The system memory 502 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 504 and / or cache memory 505. The electronic device 50 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 506 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 503 via one or more data medium interfaces. The memory 502 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0060] A program / utility 508 having a set (at least one) of program modules 507 may be stored, for example, in the memory 502, such program modules 507 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 507 generally perform the functions and / or methods of the embodiments described herein.

[0061] The electronic device 50 may also communicate with one or more external devices 509 (e.g., keyboards, pointing devices, displays 510, etc.), may communicate with one or more devices that enable a user to interact with the electronic device 50, and / or may communicate with any device that enables the electronic device 50 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface 511. Furthermore, the electronic device 50 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 512. As shown, the network adapter 512 communicates with other modules of the electronic device 50 via the bus 503. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 50, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0062] The processing unit 501 executes various functional applications and data processing by running the program stored in the system memory 502, such as implementing the security protection method combining the SRv6 SFC technology and the security resource pool provided in the embodiment of the present invention.

[0063] In another embodiment of the present invention, Figure 5 As shown, a storage medium 400 including a computer program 411 is also provided. When the computer program 411 is executed by a computer processor, it is used to perform a security protection method combining an SRv6 SFC technology with a security resource pool. The method includes: Obtain the protection function requirements, data transmission nodes and data flow information of the target network business; Select a target protection component in a preset security resource pool according to the protection function requirement, and perform SFC orchestration on the target protection component through a virtualized orchestration network to generate a security function forwarding node; Through the SRv6 technology, a service function chain of the SRv6 SFC is constructed according to the data flow information, the data transmission node and the security function forwarding node, and the service data of the target network service is transmitted according to the service function chain of the SRv6 SFC.

[0064] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device.

[0065] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0066] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0067] Computer program code for performing the operation of the embodiments of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0068] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A security protection method combining SRv6 SFC technology with a security resource pool, characterized in that: include: Obtain the protection function requirements, data transmission nodes and data flow information of the target network business; Select a target protection component in a preset security resource pool according to the protection function requirement, and perform SFC orchestration on the target protection component through a virtualized orchestration network to generate a security function forwarding node; By using SRv6 technology, a service function chain of SRv6 SFC is constructed according to the data flow information, the data transmission node and the security function forwarding node, and the service data of the target network service is transmitted according to the service function chain of SRv6 SFC; The step of transmitting the service data of the target network service according to the service function chain of the SRv6 SFC comprises: Adding the path information of the SRv6 TE Policy to the original IPv6 message of the service data at the head node of the SRv6 network, and adding an SRH extension header to the original IPv6 message to obtain a new message, wherein the SRH extension header stores the Segment List information; Controlling the service data and the new message to pass through the next node of the head node according to the path information; When the next node of the head node corresponds to the security function forwarding node, controlling the security function forwarding node to match the destination IPv6 address; If the new message hits the local SID of the security function forwarding node, the action corresponding to the local SID is executed on the service data to obtain the target service data, and the target service data is forwarded according to the path information; the attribute data is matched with the in-tunnel detection strategy, and if the match is successful, the service data is sent to the in-tunnel detection module for protection detection; If the new message does not hit the local SID of the security function forwarding node, extract the attribute data of the new message and match the attribute data with the detection policy in the tunnel; if the match fails, forward the service data and the new message according to the path information; Decapsulating the service data and the new message after matching the in-tunnel detection strategy to obtain the IPv6 message without the SRH extension header, and identifying the message type of the IPv6 message without the SRH extension header; if the message type of the IPv6 message without the SRH extension header is still a tunnel message, continuing to decapsulate the IPv6 message with the SRH extension header until the service message is obtained; If the new message hits the local SID of the security function forwarding node, the step of performing an action corresponding to the local SID on the service data to obtain the target service data includes: Sending the service data to a first target protection component corresponding to the local SID in the security function forwarding node, so that the first target protection component performs an action corresponding to the local SID on the service data to obtain primary service data; The primary business data is sent to the security function forwarding node, and the primary business data is sent to the second target protection component corresponding to the local SID in the security function forwarding node, so that the second target protection component executes the action corresponding to the local SID on the primary business data to obtain secondary business data, until the last target protection component in the security function forwarding node completes the security protection of the business data and obtains the target business data.

2. The method according to claim 1, characterized in that The step of obtaining the protection function requirement of the target network service includes: Determine the data transmission node and the data transmission relationship between different data transmission nodes according to the data flow information; Determine basic protection requirement data between different data transmission nodes based on the data transmission relationship; The user's preset protection requirement data for different data transmission nodes is obtained, and the preset protection requirement data and the basic protection requirement data are integrated to obtain the protection function requirements between different data transmission nodes.

3. The method according to claim 1, characterized in that Before the step of selecting a target protection component in a preset security resource pool according to the protection function requirement, the method further includes: Decoupling the preset protection components through the Openstack architecture to obtain underlying protection component resources corresponding to the preset protection components, wherein the preset protection components include physical network security devices and virtual network security devices; Constructing a resource management platform for managing the resources of the underlying protection components by means of software programming; The preset security resource pool is built based on the resource management platform and the underlying protection component resources.

4. The method according to claim 1, characterized in that The step of selecting a target protection component in a preset security resource pool according to the protection function requirement, and performing SFC orchestration on the target protection component through a virtualized orchestration network to generate a security function forwarding node includes: Selecting a preset component that can meet the protection function requirements in a preset security resource pool as the target protection component; Creating an SFC for the target network service based on the target protection component and a logical sequence between different target protection components, wherein the logical sequence is determined according to functions of the target protection components; Through the virtualized orchestration network, the target protection components are orchestrated according to the SFC, and a security function forwarding node including at least one target protection component is generated, so that the business data flows through each target protection component in the logical order.

5. The method according to claim 1, characterized in that The step of building a service function chain of the SRv6 SFC according to the data flow information, the data transmission node and the security function forwarding node by using the SRv6 technology includes: According to the data flow information, the address of the data transmission node and the address of the security function forwarding node are connected to obtain different network segments; According to the preset protocol, each network segment route is made reachable through the preset route, and the preset route and the network orchestrator are SRv6 SID planned through the SRv6 technology to obtain the planned preset route and the planned security function forwarding node, so that the planned preset route and the planned security function forwarding node support the SRv6 SFC function; Dynamically announce the SRv6Locator route in the planned security function forwarding node through IGP; The TE-Policy of the SRv6Locator route is configured according to the data flow information, and the service function chain of the SRv6 SFC is constructed.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining the working status of each target protection component in the security function forwarding node, and identifying health information of the target protection component based on the working status; If the health information of the target protection component is faulty, the target protection component is removed from the security function forwarding node.

7. An electronic device, characterized in that: The electronic device comprises: One or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the security protection method combining the SRv6 SFC technology and the security resource pool as described in any one of claims 1-6.

8. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions, when executed by a computer processor, are used to execute the security protection method combining the SRv6 SFC technology with a security resource pool as described in any one of claims 1 to 6.

Images