Security architecture system for realizing software definition security and security controller

Abstract

The invention discloses a security architecture system for realizing software definition security and a security controller. The security controller comprises a management module, an event scheduling module, a polling module and a flow monitoring module, wherein the management module is used for providing at least one piece of security equipment or at least one security application for registration; the polling module is used for polling a network controller to acquire data flow; the flow monitoring module is used for detecting the data flow according to a triggering condition; the event scheduling module is used for generating an execution strategy event according to the detection result of the triggering condition.

Description

technical field [0001] The invention relates to a computer network architecture, in particular to a computer network security controller and a security architecture system with the security controller. Background technique [0002] Software-Defined Networking (SDN, Software-Defined Networking) reconstructs the network in the form of software, subverting the existing communication and management mode of the network, and has received more and more attention in the industry and academia in recent years. Separate data forwarding from routing control, and use a program to re-plan the network in a centrally controlled manner to effectively control network traffic. [0003] Software-defined security adopts the design idea of ​​SDN architecture, separates the secure control plane and data plane, realizes the reconstruction of security services through the programmability provided by the control plane, and maximizes the security opportunities brought by SDN. [0004] Although softwa...

AI Technical Summary

Problems solved by technology

[0004] Although software-defined networking and Network Function Virtualization (NFV, Network Function Virtualization) have many advantages, they blur and virtualize network boundaries, making many traditional security products unsuitable

[0005] For example, in the current DDoS attack, the attacker generally attacks a single server, but in a virtualized environment, due to the fixed physical bandwidth, the attacker may attack multiple virtual machines (VMs) of a tenant, but each VM The traffic will not exceed the predetermined threshold, so when dealing with such attacks, the security application (Security Application) needs to consider the environmental requirements of multi-tenants in the virtualized cloud environment when making fine-grained security protection decisions, which also makes the security decision process compared with traditional The anti-DDoS attack strategy is more complex

Images