A cloud security group component automatic pull-up deployment method

Abstract

The application discloses a kind of cloud security component automation pull deployment method, belong to cloud security resource pool virtualization scheduling technique;Receive tenant security capability opening request, complete tenant identity and quota check, according to mirror hardware constraint candidate node set is filtered, based on combination empowerment-grey correlation analysis model each candidate cluster node comprehensive grey correlation degree is solved;Call virtualization bottom interface to complete security component mirror loading, virtual machine instance creation, storage network resource mounting;Multi-dimensional health detection confirms instance running state, returns receipt successfully, triggers fault rollback release resource abnormally;The application gets rid of cloud manufacturer lock, scheduling strategy has anti-load disturbance ability, two-stage node optimizes and avoids scheduling swing, supports Xinxing-non Xinxing heterogeneous cluster scheduling, pull time consumption is not greater than 5 minutes, supports 200 tenants large-scale concurrency, balances cluster load, has fault closed loop processing, adapts to group cloud security resource pool business scene.

Description

Technical Field

[0001] This invention relates to the field of cloud security resource pool virtualization scheduling technology, specifically a method for automatically launching and deploying cloud security components. Background Technology

[0002] With the rapid development of multi-cloud digital business at the group level, the scale of tenants of large industry cloud platforms such as Huaneng Cloud is expanding rapidly, and the demand for security protection components such as firewalls, WAFs, bastion hosts, and vulnerability scanners is surging. In the traditional model, the deployment of cloud security components relies on operation and maintenance personnel to log in to the virtualization platform to manually create virtual machines, mount storage, configure networks, and configure traffic redirection strategies. The deployment steps are cumbersome, the risk of human error is high, and the deployment of a single security component often takes more than 15 minutes, which cannot meet the business demand of tenants on the cloud to quickly activate security capabilities.

[0003] Some existing cloud vendors' native security scheduling solutions are deeply tied to their own virtualization infrastructure, resulting in vendor technology lock-in. This makes it difficult to adapt to mixed heterogeneous cluster scenarios with both domestically developed and non-domestically developed nodes, and it cannot simultaneously support the new SRv6 IPv6 network and the traditional NETCONF policy-based routing mode. Most existing scheduling strategies use simple weighting or random allocation, which is not robust to dynamic fluctuations in cluster load and small-sample disturbances, making them prone to node load skew and low cluster resource utilization. At the same time, the lack of a fine-grained tenant quota verification mechanism makes it easy for over-quota resource allocation to occur, posing a risk to cluster stability.

[0004] Existing deployment technologies lack end-to-end fault rollback and multi-dimensional health detection logic. When image corruption or network interface anomalies occur during deployment, a large number of zombie virtual machines and residual storage volumes are generated, continuously consuming valuable virtualization resources. At the same time, logs cannot automatically carry tenant tags. When connecting to external log aggregation platforms and situational awareness platforms, additional manual secondary processing of log data is required. The data flow is cumbersome and it is difficult to meet the business scenarios of opening security components for large-scale tenants of more than 200 concurrently. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention aims to provide an automated deployment method for cloud security components. This method solves the technical problems of low efficiency, vendor lock-in, difficulty in adapting to heterogeneous cluster scheduling, insufficient robustness of scheduling under dynamic load disturbances, scheduling oscillations under equal scoring conditions, lack of quota control, residual resources resulting from failures, and the inability to automatically carry tenant tags in logs. This invention decouples heterogeneous virtualization infrastructure, enabling rapid automated deployment of security components in multi-tenant scenarios, with deployment time controlled within 5 minutes. It adapts to hybrid clusters of domestic and non-domestic IT innovation, and is compatible with traditional networks and SRv6 / IPv6 networks. It includes quota verification, a combined weighting-grey relational analysis scheduling model, two-level node selection logic, fault rollback, and multi-dimensional health checks, enabling integration with external security operation platforms.

[0006] A method for automatically deploying cloud security components is proposed, applied to a cloud security resource pool management platform. The platform interfaces with underlying virtualization interfaces, including cloud host interfaces, block storage interfaces, image interfaces, network interfaces, EIP interfaces, and monitoring interfaces. The method includes: receiving a security capability activation request from a tenant; parsing the tenant identity identifier, security component type, resource specifications, and network routing parameters carried in the request; performing tenant permission verification and resource quota verification based on the tenant identity identifier; calling the underlying virtualization interfaces to retrieve the status data of available compute, storage, and network resources in the cluster; and implementing resource scheduling policies. The system briefly filters and matches idle virtualization resources, loads the corresponding security component images, and automatically completes virtual machine instance creation, network card mounting, storage volume mounting, and EIP binding. It then distributes traffic redirection configurations, orchestrating tenant business traffic through a service chain to the already launched security component instance. Finally, it performs instance health checks, and if the check result indicates normal operation, it returns a deployment completion receipt to the tenant portal. The total time for a complete security component launch is ≤5 minutes, and it supports concurrent scheduling for at least 200 tenants without authorization limits. The underlying architecture is a 3-node domestically produced server distributed cluster, employing a multi-replica storage mechanism to ensure high availability and dynamic migration of instances.

[0007] Preferably, the resource scheduling strategy adopts a combined weighting-grey relational analysis model to calculate the grey relational degree of each physical node. The formula for calculating the grey relational coefficient of a node is as follows:

[0008] In the formula, , ; Comprehensive grey relational degree The weights of the indicators are obtained by assigning weights to the combination, where m is the total number of evaluation indicators; The comprehensive grey relational degree corresponding to each candidate cluster node is calculated. The comprehensive grey relational degree of all candidate nodes Perform size comparison and filter based on comprehensive grey relational analysis. The candidate cluster node with the largest value will be selected as the target node for this security component deployment; when two or more nodes have a combined grey relational value... When all nodes are equal and have the same maximum value, the node with the smallest historical load penalty factor is selected from the batch of equal-value nodes as the deployment target node; the evaluation metrics include CPU remaining rate, memory remaining rate, storage remaining rate, network bandwidth remaining rate, and node historical load penalty factor.

[0009] Preferably, before performing the security component instance creation step, a tenant isolation preprocessing step is also included: obtaining the network segment identifier and VLAN ID corresponding to the tenant, generating a tenant-specific network tag, injecting the tenant-specific network tag into the virtual network card configuration, and realizing network plane logical isolation of different tenant security component instances.

[0010] Preferably, the traffic routing configuration includes: calling the NETCONF interface to send policy routes to the switch, or resolving the APN6 traffic identifier based on the SRv6 protocol, binding the APN6 traffic identifier with the tenant identity identifier, and completing the service chain routing orchestration of IPv6 traffic.

[0011] Preferably, instance health detection adopts multi-dimensional joint detection, including virtual machine process liveness detection, component API interface connectivity detection, and business traffic forwarding simulation detection; when N consecutive detections fail, the instance is automatically migrated and rebuilt, where N is a configurable positive integer.

[0012] Preferably, the process also includes a log tagging step: collecting the running logs and alarm logs of the activated security components, tagging each log entry with the tenant identity as log metadata, outputting a log data stream with tenant tags, and pushing it to a third-party log aggregation and situational awareness platform.

[0013] Preferably, it also includes an elastic scaling-up step: periodically collecting the CPU, memory, and session count performance metrics of the security component instance; when the metrics exceed the set threshold, re-invoking the combined weighting-grey relational analysis model in claim 2 to select the target node, automatically adding a security component instance to achieve elastic scaling of security capabilities; when the instance load is below the lower limit threshold for a long period of time, automatically releasing idle instances to reclaim virtualization resources.

[0014] Preferably, it supports mixed cluster scheduling of domestic and non-domestic innovation nodes, identifies the target node attributes when parsing the activation request, and only allocates the image of the domestic security component to the domestic innovation node during scheduling, so as to realize unified scheduling and start-up of heterogeneous clusters.

[0015] Preferably, it also includes a dynamic quota management step, constructing a tenant resource quota determination formula:

[0016] In the formula, For the remaining available quota of the tenant; Allocate total quotas to tenants; The resources occupied by the i-th running security component for the tenant; Reserved coefficient for buffer; This is a global buffer resource for the system; when A value greater than 0 is required to allow the security component startup process to be executed.

[0017] Preferably, it also includes a fault rollback mechanism; if an interface call exception, image loading failure, or resource insufficiency exception occurs during the security component startup process, a rollback operation is performed to destroy the already created virtual machine instances, storage volumes, and network configurations, release the virtualization resources that have been occupied, and return a failure notification with an exception code to the tenant portal.

[0018] This method interfaces with the underlying cloud host interface, block storage interface, image interface, network interface, EIP interface, and monitoring interface of virtualization; it receives tenant security capability activation requests, completes tenant identity verification and quota verification, and filters out a set of candidate nodes that meet the constraints of image type and hardware attributes; it uses a combined weighting-grey relational analysis model to calculate the comprehensive grey relational degree of each candidate node. .

[0019] Among them, the comprehensive grey relational degree It characterizes the proximity of candidate nodes in the cluster to the ideal optimal resource node. The higher the value, the more abundant the remaining CPU, memory, storage, and network resources of the node, the better its historical load status, and the more suitable it is for deploying new security component instances. The scheduling selection adopts a two-level judgment logic: the first level compares the comprehensive gray relational degree of all candidate nodes. Select The largest node is used as the deployment target; the second level considers the combined grey relational degree of two or more nodes. When the values ​​are equal and both are the maximum value, a second judgment is made. The node with the smallest historical load penalty factor is selected from the set of equal nodes as the final deployment target node, thereby avoiding scheduling sway phenomenon.

[0020] After determining the target deployment node, the security component image is loaded, and virtual machine instance creation, network card mounting, storage volume mounting, and EIP binding are completed. NETCONF or SRv6-APN6 is called to orchestrate and redirect business traffic service chains. Multi-dimensional instance health checks are performed; if the checks are normal, a deployment success receipt is returned to the tenant. If an anomaly occurs during the startup process, a fault rollback is performed, destroying intermediate instances, storage, and network configurations. Security component runtime logs are collected, automatically tagged with tenant information, and pushed to a third-party platform. Simultaneously, the gray-association scheduling model is reused to achieve elastic scaling of the security component. The underlying cluster uses distributed multi-replica storage to ensure high availability and dynamic migration of instances, supporting concurrent security capability activation for no fewer than 200 tenants.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention decouples heterogeneous virtualization infrastructures, providing a single management platform compatible with both domestically developed and non-domestically developed hybrid clusters. It also supports traditional NETCONF traffic redirection and the next-generation IPv6 network orchestration of SRv6-APN6. It establishes a complete automated link from request parsing, resource filtering, instance deployment, traffic orchestration, health detection to result receipt, with the security component startup time controlled within 5 minutes, meeting the technical indicators of the group's cloud security resource pool.

[0022] 2. A combined weighting-grey relational analysis model is used to complete resource assessment, which has strong anti-disturbance capabilities against instantaneous load fluctuations and sampling noise in the cluster. A two-level selection logic is set up to prioritize the node with the highest comprehensive grey relational degree. When the relational degree is equal, the node with the smallest historical load penalty factor is further selected to solve the task scheduling swing problem under the same score conditions. Admission verification is completed by combining the tenant quota determination formula, which supports large-scale concurrency of 200 tenants, significantly balances the cluster load, and improves the overall resource utilization rate.

[0023] 3. It has multi-dimensional joint health detection and a complete fault rollback mechanism. When a failure such as image anomaly or interface call failure occurs during the startup process, it automatically destroys all intermediate virtualization resources, eliminates zombie virtual machines and residual storage volumes, and reduces the pressure of operation and maintenance.

[0024] 4. The security component automatically appends tenant identity meta tags to the output logs, natively connecting to Huaneng Blue Shield Log Aggregation System and Network Situation Awareness Security Operation Platform, eliminating the need for manual secondary processing of log data; it reuses the same scheduling model to achieve elastic scaling of the security component, adapting to dynamic changes in business load; tenant network tag injection achieves strong isolation of tenant network logic, ensuring the privacy and security of tenant business and data on the cloud. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the overall process of the present invention. Detailed Implementation

[0026] This invention discloses an automated deployment method for cloud security components, implemented according to claims 1-10. The overall execution flow is briefly described as follows: A tenant security activation request is received; request parameters are parsed; tenant identity verification and tenant quota verification are performed; cluster nodes are filtered based on image type and hardware attribute constraints to obtain a candidate node set; five indicators—CPU remaining rate, memory remaining rate, storage remaining rate, network bandwidth remaining rate, and node historical load penalty factor—are collected from the nodes within the candidate set, and dimensionless normalization is performed to construct an optimal reference sequence of indicators; these indicators are substituted into the grey relational coefficient formula, combined with the indicator weights obtained through combined weighting, to calculate the comprehensive grey relational degree of each candidate node. A two-level selection process is implemented: the first level compares the comprehensive grey relational analysis and selects the optimal value. Maximum node; if multiple nodes If the equal value is the largest, the node with the smallest historical load penalty factor in the equal value set is selected as the deployment target node; after determining the deployment node, the underlying virtualization interface is called to complete image loading, virtual machine creation, network card mounting, storage volume mounting, and EIP binding; depending on the business scenario, NETCONF policy routing is executed or SRv6-APN6 tenant traffic binding and orchestration is performed; multi-dimensional health detection is performed on process liveness, API connectivity, and traffic simulation; if the detection is normal, a deployment success receipt is returned; if an anomaly occurs during the start-up process, a fault rollback is triggered, destroying all intermediate resources; logs are automatically tagged with tenants and pushed to a third-party platform; instance load metrics are collected periodically, and a two-level optimal gray relational model is reused to complete elastic scaling up and down.

[0027] Example 1 A 3-node domestically produced Kunpeng 920 server cluster, all nodes are domestically developed (IT) nodes, using a traditional IPv4 network and NETCONF switches for traffic routing. It handles 40 concurrent tenant requests for Web Application Firewall security component startup tasks; resolution... Set to 0.5; use combined weighting to output the weights of five indicators: CPU remaining rate, memory remaining rate, storage remaining rate, network bandwidth remaining rate, and node historical load penalty factor; buffer reservation coefficient. Set the threshold to 0.1, and set the health detection failure threshold N=3.

[0028] Experimental Procedure: 40 WAF component activation requests were imported in batches into the cloud security resource pool management platform. Each request carried a unique tenant ID, tenant VLAN identifier, WAF image identifier, and resource specification parameters. The system performed tenant identity verification and called the tenant quota determination formula to verify the tenant's remaining quota. Only when The scheduling process continues only if the value is >0; this embodiment uses only domestically produced WAF images, all three servers meet the hardware constraints, and all are included in the candidate node set; measured data of five indicators from the three nodes in the candidate set are collected, dimensionless normalization is performed, and the optimal reference sequence corresponding to each indicator is constructed. Substituting the values ​​into the grey relational coefficient calculation formula yields the relational coefficients of each indicator for each node. Combining this with the combined weighting, the comprehensive grey relational degree of each candidate node is calculated. Perform a two-level selection process: compare all candidate nodes. Numerical values, selecting comprehensive grey relational degree Maximum node; when two nodes exist If the values ​​are equal and both are the maximum value, a secondary judgment is performed, selecting the node with the smaller historical load penalty factor among the equal-value nodes as the target node for this deployment. After determining the deployment node, the underlying virtualization interface is called to complete the creation of virtual machine instances, mounting of storage volumes, and mounting of virtual network cards. The NETCONF interface is called to issue policy routes to the switch to complete traffic redirection. Multi-dimensional health checks are performed, including process liveness detection, component API interface connectivity detection, and simulated business traffic forwarding detection. After successful deployment, the tenant identity identifier is added as a meta tag to the security component log and pushed to the Huaneng Blue Shield log aggregation system. The time taken to fully start each task is recorded, and the average CPU and memory utilization of each node in the cluster is collected. Two task image loading anomalies are artificially created, and the fault rollback operation is observed to check whether there are any residual virtual machine instances or storage volume resources in the system.

[0029] Experimental Results: All 40 WAF components were successfully launched and deployed, with a maximum launch time of 3 minutes and 51 seconds for a single instance, meeting the ≤5-minute technical requirement; the average CPU utilization of the three cluster nodes were 41.3%, 39.6%, and 40.2% respectively, indicating balanced cluster load and preventing scheduling misjudgments in the face of momentary fluctuations in metrics; in multiple scenarios where the overall gray correlation degree of nodes was close or equal, secondary judgment using historical load penalty factors effectively avoided scheduling swings and prevented a large number of tasks from being scheduled to the same node; the two tasks with image loading anomalies were successfully executed and rolled back, with virtual machine instances, storage volumes, and network configurations all destroyed and released, and no zombie resources were found; all security logs carried tenant tags and could be directly connected to the log aggregation system without manual secondary processing.

[0030] Example 2 A hybrid heterogeneous cluster consisting of 2 domestically produced Kunpeng nodes (based on domestic IT innovation) and 1 x86 non-domestic IT innovation node, operating in an SRv6 / IPv6 network environment with APN6 traffic identification, supporting 80 concurrent tenants. The application includes various security components such as access firewalls, vulnerability scanners, and bastion hosts; resolution... Set to 0.5; dynamically output the weights of five scheduling indicators using combined weighting; buffer reservation coefficient. Set the threshold to 0.15, and the health detection failure threshold N=3.

[0031] Experimental Procedure: Eighty different security component activation requests were submitted in batches, some using domestically produced security images. The system parsed the image attributes and performed candidate node filtering: for domestically produced images, only two Kunpeng-based security innovation nodes were included in the candidate set; for ordinary non-domestic images, all three servers were included in the candidate set. Tenant quota determination and verification were performed. Five indicator data of nodes in the candidate set were collected, normalized, and an optimal reference sequence was constructed. The grey relational coefficient and the comprehensive grey relational degree of each node were calculated. A two-tiered selection process is implemented, prioritizing the selection of [specific criteria]. Maximum node, multiple nodes When the equivalence value is maximized, the node with the smallest historical load penalty factor in the equivalence set is selected as the deployment target; after the instance deployment is completed, the SRv6 packet APN6 traffic identifier is parsed, and the APN6 identifier is bound to the tenant identity to realize SRv6 mode service chain orchestration and traffic redirection; multi-dimensional instance health detection is performed; the start-up time of each security component is counted, and the CPU and memory resource utilization of three servers in the heterogeneous cluster are collected; three network interface call failure exceptions are artificially simulated to observe the effect of fault rollback execution; the completeness of the tenant-tagged logs pushed to the network situation awareness security operation platform is counted.

[0032] Experimental Results: All 80+ security components were automatically launched, with a maximum launch time of 4 minutes and 30 seconds, kept within 5 minutes; all domestically produced images were deployed to Kunpeng IT innovation nodes, not to x86 non-IT innovation nodes, and the heterogeneous node filtering logic functioned normally; the average CPU load of the three nodes was 37.6%, 35.1%, and 36.2% respectively, indicating balanced cluster load, and local indicator disturbances did not cause scheduling anomalies; in scenarios with equivalent comprehensive gray correlation, secondary optimization was performed using historical load penalty factors to avoid scheduling sway; all three network interface anomaly tasks were rolled back with no residual virtualization resources; all output logs carried tenant identity tags and could be fully pushed to the network situation awareness security operation platform.

[0033] Example 3 A 3-node Kunpeng domestic cluster, featuring a hybrid IPv4+SRv6 dual-stack network, handles high-pressure scenarios with 200 tenants simultaneously initiating security component activations, covering 12 security component categories as specified in the specification; resolution coefficient. The weighting factor is set to 0.5; the weights of the five indicators are dynamically updated based on the real-time load of the cluster; the buffer reservation coefficient α is set to 0.2, and the health detection failure threshold N=2.

[0034] Experimental Procedure: 200 security component activation tasks belonging to different tenants were submitted at once; the system performed batch tenant identity verification and tenant quota determination; all 3 nodes met the deployment conditions and were included in the candidate node set; node operation indicators were collected and normalized to construct the optimal reference sequence; a combined weighting-grey relational analysis model was run to output the comprehensive grey relational degree of each candidate node. A two-level selection process is implemented to determine the best candidate. Maximum node; when there are multiple nodes When both are at their maximum values, the node with the lowest historical load penalty factor is selected as the deployment target node; the NETCONF traffic redirection or SRv6-APN6 binding traffic redirection mode is automatically selected based on the request parameters; instance creation and storage network mounting are completed, and multi-dimensional health detection is performed; the start-up time of all tasks is recorded, and the resource load of cluster nodes is statistically analyzed; four task EIP binding interface anomalies are artificially simulated to observe the fault rollback effect; elastic expansion verification: continuous pressure is applied to some running security components, the system re-filters to obtain a set of candidate nodes, and the combined weighting-grey relational analysis model is run again. The expansion target node is selected according to the two-level selection rule, and security component instances are automatically added; the verification logs are simultaneously output to the Huaneng Blue Shield log aggregation system and the network situation awareness security operation platform.

[0035] Experimental Results: All 12 security components corresponding to 200 tenants were automatically started, with a maximum start time of 4 minutes and 53 seconds, meeting the 5-minute limit; the average CPU load of the 3 cluster nodes remained at 44.1%, 43.3%, and 43.9%; in high-concurrency scenarios with instantaneous noise disturbances in metrics, no severe resource skew occurred; under high concurrency, the overall gray correlation degree of nodes appeared multiple times, and scheduling swings were effectively avoided by relying on secondary judgment rules, and tasks were evenly distributed to each node; all 4 EIP binding anomalies triggered complete rollbacks, with no residual virtual machines or storage volume resources; after business pressure was increased, elastic expansion was triggered, and the optimal idle node was automatically selected to generate a new instance according to the two-level selection rules; security logs with tenant tags were output to two sets of third-party platforms, and the data was complete and usable.

[0036] Comparative Example 1 The system consists of a cluster of 3 domestically produced Kunpeng IT innovation nodes, a traditional IPv4 network, and 40 concurrent tenants applying for WAF components. It does not use the combined weighting-grey relational analysis scheduling model of this invention, but adopts a simple random node allocation strategy, has no tenant quota determination formula, and lacks a fault rollback mechanism.

[0037] Experimental procedure: Submit 40 WAF activation tasks, select deployment nodes randomly, disable quota verification logic and failover process; record startup time and collect CPU and memory load data of three servers; artificially create two image loading failure tasks without triggering rollback and observe resource residue; do not automatically append tenant tags to log output and output raw log data.

[0038] Experimental results: The maximum startup time for 40 WAF components reached 7 minutes and 22 seconds, with some tasks exceeding the 5-minute target; the average CPU load of the three servers was 64.1%, 23.2%, and 22.7% respectively, showing a severe polarization in node resources, with one node overloaded and the other two idle; image loading failures resulted in two zombie virtual machine instances and corresponding storage volume resources, requiring maintenance personnel to log in to the virtualization platform for manual cleanup; the original logs lacked tenant tags, requiring manual secondary script development to complete tenant tagging before integration with external security platforms.

[0039] Comparative Example 2 The heterogeneous cluster (2 Kunpeng Xinchuang nodes + 1 x86 node), SRv6 IPv6 network, 80 concurrent tenants, and multiple security components; it lacks heterogeneous image differentiation scheduling logic, cancels the combined weighting-grey relational analysis scheduling model, has no quota verification, and has no APN6 tenant binding logic.

[0040] Experimental process: Submit 80 activation requests, which included a large number of domestically produced security images. Nodes were randomly assigned without distinguishing image types or performing APN6 tenant binding. Deployment time and cluster load were recorded. Three network interface anomalies were simulated to observe resource residue. The SRv6 traffic redirection effect was verified, and logs from a third-party platform were checked.

[0041] Experimental results: Some domestically developed security images were scheduled and deployed to x86 non-IT innovation nodes, and the instances failed to start directly; the maximum time to successfully start a task was 6 minutes and 46 seconds, exceeding the 5-minute target; there were large differences in the load of cluster nodes; abnormal network interfaces generated zombie virtual machines and residual storage volumes; SRv6 traffic could not complete tenant information binding, and traffic from different tenants was mixed up; the original logs had no tenant tags and could not be directly connected to the situational awareness platform.

[0042] Comparative Example 3 A 3-node domestically produced Kunpeng cluster with IPv4 and SRv6 dual-stack network, 200 concurrent tenants, and 12 types of security components; it eliminates the combined weighting-grey relational analysis scheduling model, eliminates tenant quota determination, enables fault-free rollback, and features adaptive logic without dual traffic redirection mode.

[0043] Experimental process: Submit 200 multi-tenant, multi-type security component activation tasks, with nodes randomly assigned in a simple manner, without quota verification or distinction between NETCONF / SRv6 traffic redirection modes; record deployment status, time consumption, and cluster load; artificially simulate 4 EIP binding anomalies; output test logs.

[0044] Experimental results: 21 out of 200 tasks failed to launch; the longest launch time for a successful task was 8 minutes and 41 seconds, exceeding the 5-minute target; the cluster experienced single-node CPU utilization exceeding 83% overload, with other nodes having idle resources; abnormal EIP binding generated 4 groups of zombie virtual machines and storage volume resources; some tenants' business traffic redirection modes were misconfigured, causing crosstalk between tenants; logs lacked tenant tags, requiring additional script processing, and could not be directly integrated with two third-party security platforms.

Claims

1. A method for automatically launching and deploying cloud security components, characterized in that, This system is applied to a cloud security resource pool management platform, which interfaces with the underlying virtualization interface, including cloud host interface, block storage interface, image interface, network interface, EIP interface, and monitoring interface. The method includes: receiving security capability activation requests from tenants; parsing the tenant identity identifier, security component type, resource specifications, and network routing parameters carried in the request; performing tenant permission verification and resource quota verification based on the tenant identity identifier; calling the underlying virtualization interface to retrieve the status data of available compute, storage, and network resources in the cluster; and filtering and matching idle resources based on resource scheduling policies. Virtualization resources load the corresponding security component image, automatically completing virtual machine instance creation, network card mounting, storage volume mounting, and EIP binding; traffic redirection configuration is issued, directing tenant business traffic to the started security component instance through service chain orchestration; instance health detection is completed, and when the detection result is normal operation, a deployment completion receipt is returned to the tenant portal; the total time for the security component to be fully started is ≤5 minutes, supporting concurrent scheduling of no less than 200 tenants without authorization limit, the underlying layer is a 3-node domestic server distributed cluster, and a multi-replica storage mechanism is used to ensure high availability and dynamic migration of instances.

2. The automated deployment method for cloud security components according to claim 1, characterized in that, The resource scheduling strategy employs a combined weighting-grey relational analysis model to calculate the grey relational degree of each physical node. The formula for calculating the grey relational coefficient of a node is as follows: In the formula, ， ； Comprehensive grey relational degree The weights of the indicators are obtained by assigning weights to the combination, where m is the total number of evaluation indicators; The comprehensive grey relational degree corresponding to each candidate cluster node is calculated. The comprehensive grey relational degree of all candidate nodes Perform size comparison and filter based on comprehensive grey relational analysis. The candidate cluster node with the largest value will be selected as the target node for this security component deployment; when two or more nodes have a combined grey relational value... When all nodes are equal and have the same maximum value, the node with the smallest historical load penalty factor is selected from the batch of equal-value nodes as the deployment target node; the evaluation metrics include CPU remaining rate, memory remaining rate, storage remaining rate, network bandwidth remaining rate, and node historical load penalty factor.

3. The automated deployment method for cloud security components according to claim 2, characterized in that, Before performing the security component instance creation step, a tenant isolation preprocessing step is also included: obtaining the network segment identifier and VLAN ID corresponding to the tenant, generating a tenant-specific network tag, injecting the tenant-specific network tag into the virtual network card configuration, and realizing network plane logical isolation of different tenant security component instances.

4. The automated deployment method for cloud security components according to claim 3, characterized in that, The traffic routing configuration includes: calling the NETCONF interface to send policy routes to the switch, or resolving the APN6 traffic identifier based on the SRv6 protocol, binding the APN6 traffic identifier with the tenant identity identifier, and completing the service chain routing orchestration of IPv6 traffic.

5. The automated deployment method for cloud security components according to claim 4, characterized in that, Instance health detection employs multi-dimensional joint detection, including virtual machine process liveness detection, component API interface connectivity detection, and business traffic forwarding simulation detection. If the detection fails N times consecutively, the instance will be automatically migrated and rebuilt, where N is a configurable positive integer.

6. The automated deployment method for cloud security components according to claim 5, characterized in that, It also includes a log tagging process: collecting the running logs and alarm logs of the activated security components, tagging each log entry with the tenant identity as the log metadata tag, outputting a log data stream with tenant tags, and pushing it to a third-party log aggregation and situational awareness platform.

7. The automated deployment method for cloud security components according to claim 6, characterized in that, It also includes elastic scaling steps: periodically collecting the CPU, memory, and session count performance metrics of security component instances; when the metrics exceed the set threshold, the combined weighting-grey relational analysis model in claim 2 is invoked again to select the target node, and security component instances are automatically added to achieve elastic scaling of security capabilities; when the instance load is below the lower limit threshold for a long period of time, idle instances are automatically released to reclaim virtualization resources.

8. The automated deployment method for cloud security components according to claim 7, characterized in that, It supports mixed cluster scheduling of domestic and non-domestic innovation nodes. When parsing the activation request, it identifies the target node attributes and allocates only the image of the domestic security component to the domestic innovation node during scheduling, so as to realize unified scheduling and start-up of heterogeneous clusters.

9. The automated deployment method for cloud security components according to claim 8, characterized in that, It also includes dynamic quota management steps and the construction of a tenant resource quota determination formula: In the formula, For the remaining available quota of the tenant; Allocate total quotas to tenants; The resources occupied by the i-th running security component for the tenant; Reserved coefficient for buffer; This is a global buffer resource for the system; when A value greater than 0 is required to allow the security component startup process to be executed.

10. The automated deployment method for cloud security components according to claim 9, characterized in that, It also includes a fault rollback mechanism; if an interface call exception, image loading failure, or resource insufficiency exception occurs during the startup of the security component, a rollback operation is performed to destroy the created virtual machine instances, storage volumes, and network configurations, release the virtualization resources that have been occupied, and return a failure notification with an exception code to the tenant portal.

Images