Deployment optimization method of software defined firewall based on openstack cloud platform

Abstract

This invention discloses a deployment optimization method of a software defined firewall based on an openstack cloud platform. The firewall is taken as a specific implementation module of a FWAAS standard interface; business security domains are partitioned on the basis of tenant businesses; security resource pooling management is realized in independent business security domains; a pre-allocationmechanism is adopted for security resources inside a security resource pool; and nodes can be dynamically selected in the security business domains with an optimized scheduling module during creationof the firewall according to the demand of a tenant on traffic, and a firewall instance is deployed in a security node which meets the demand of the tenant. A quick response can be made to the demandof the tenant on a security business through the method; the ability to quickly deploy the security businesses is provided for the FWAAS of the Openstack through the optimized scheduling module; andsecurity demands corresponding to different businesses are separated through a business security domain module, and the tenant can quickly acquire the firewall instance, so that a security policy is quickly configured, and the problems of slow deployment of firewall instances, delayed response and the like in an original scheme of the Openstack are solved.

Description

Technical field [0001] The invention belongs to the field of network security protection, and particularly relates to a deployment optimization method of a software-defined firewall based on an openstack cloud platform. Background technique [0002] With the popularization of cloud computing, the IT transformation brought about by software-defined data centers is unstoppable. The improvement in IT efficiency and the savings in IT costs brought about by this have benefited major enterprises, institutions, and operators, but they have also enabled traditional data The network security architecture of the center is no longer applicable to the clouded data center. The concept of Software Defined Security (SDS) is based on the principle of combining physical or virtual network security devices with their access modes, deployment methods, and functions For decoupling, the bottom layer is abstracted as resources in the security resource pool, and the top layer is unified through softwar...

AI Technical Summary

Problems solved by technology

[0005] As a cloud computing framework, OpenStack has the capability of software-defined firewall (FWaaS), but as a security resource, the firewall simply instantiates the firewall without optimizing the deployment and scheduling of the firewall instance. Deployment is slow, deployment distribution is unreasonable, and cannot satisfy tenants' rapid response to security services

[0006] From the perspective of OpenStack firewall deployment, all virtual routers of tenants are deployed on network nodes in OpenStack, and firewall instances are actually virtual routers. Network nodes not only provide virtual routing services, but also provide dhcp and metadata services at the same time; a large number of centralized Deploying firewall instances on network nodes will cause deployment bottlenecks. From the tenant's business perspective, there will also be traffic bottlenecks.

Images