基于软件定义安全的资源调度机制研究与实现

发布时间：2018-12-24 09:42

【摘要】：随着网络发展触及世界的每个角落,网络在加速“世界被抹平”过程的同时,安全问题的层出不穷也给网络部署运维带来了一定的困扰。安全威胁影响了网络的稳定性和发展,成为了不容忽视的问题。并且随着网络和业务环境的发展,传统的安全运维、安全服务面临了新的挑战:(1)原有的安全设备不具有开放性,导致安全设备封闭僵化,不便于后期扩展,也阻碍了业务部门快速适应业务变化的需求,同时容易造成供应商锁定。(2)安全运维系统依赖于当前网络环境,安全设备的部署要根据网络拓扑、实际环境进行调整配置,难以实现高效的迁移重用。(3)网络安全策略还停留在落后的人工配置阶段,安全策略部署的有效性和合理性极大的依赖于运维人员,运维成本也因此居高不下。目前随着软件定义网络SDN的兴起,出现了各种各样的软件定义系统,这些概念是围绕着把控制层从数据层分离出来,而在安全领域也不例外,软件定义安全SDS也渐渐进入大家的视野。相对于传统的僵硬分散的安全机制,软件定义安全SDS通过把安全机制从安全硬件层提取的到软件层的方法提供一种灵活和集中的解决方案。现已提出的各种软件定义安全架构,基本上都是借鉴了SDN的三层架构思想,把控制层从数据层分离出来。然而现在提出和已实现的各种软件定义安全SDS架构中,都忽略了底层物理资源的资源调度机制,并且这些已提出的SDS架构的特点的实现都离不开资源调度机制。因此本文提出一种基于软件定义安全的资源调度机制,设计了南向API接口、安全资源抽象和负载均衡调度算法,以扫描服务为应用案例,提出了包含应用层、控制层和物理层的原型系统,进一步研发改造了安全控制器资源调度软件模块、物理层扫描器软件模块,搭建了实验环境,实验表明,基于软件定义安全的资源调度机制能够有效实现安全资源的调度,支持安全资源的负载均衡。主要工作如下:第一、通过学习研究目前学术界以及市场上的主要安全厂商对SDS的理解认识的基础上,进一步的对SDS架构及特点进行分析,最后本文提出基于软件定义安全的资源调度机制。第二、本文通过设计统一的南向API、底层安全资源虚拟化、负载均衡的调度算法,实现了的基于软件定义安全的资源调度机制的原型系统,并且通过一个实际应用测试了安全资源调度机制的效果。
[Abstract]:With the development of the network which touches every corner of the world, the network accelerates the process of "the world being wiped out", and at the same time, the endless emergence of security problems also brings some troubles to the network deployment and maintenance. Security threats affect the stability and development of the network and become a problem that can not be ignored. And with the development of network and business environment, the traditional security operation and maintenance, security services are faced with new challenges: (1) the original security equipment is not open, resulting in the security equipment closed and rigid, which is not convenient for later expansion. It also hinders the business department to adapt to the needs of business changes quickly and easily causes vendor locking. (2) the security operation and maintenance system depends on the current network environment, and the deployment of security equipment should be adjusted according to the network topology and the actual environment. It is difficult to realize efficient migration reuse. (3) the network security policy is still in the backward manual configuration stage, the effectiveness and rationality of security policy deployment depend heavily on the operators, and the cost of operation and maintenance is high. At present, with the rise of software definition network SDN, a variety of software definition systems have emerged. These concepts revolve around separating the control layer from the data layer, and it is no exception in the field of security. The software definition security SDS also gradually enters everybody's vision. Compared with the traditional rigid and decentralized security mechanism, the software definition security SDS provides a flexible and centralized solution by extracting the security mechanism from the security hardware layer to the software layer. All kinds of software definition security architecture have been put forward, which are based on the three-tier architecture of SDN and separate the control layer from the data layer. However, the resource scheduling mechanism of the underlying physical resources is ignored in the proposed and implemented software definition security SDS architecture, and the implementation of these proposed SDS architectures is inseparable from the resource scheduling mechanism. Therefore, this paper proposes a resource scheduling mechanism based on software definition security, designs a southward API interface, security resource abstraction and load balancing scheduling algorithm, taking scanning service as an application case, proposes an application layer. The prototype system of the control layer and the physical layer has further developed and modified the resource scheduling software module of the security controller and the scanner software module of the physical layer, and the experimental environment has been built. The resource scheduling mechanism based on software definition security can effectively realize the scheduling of security resources and support the load balance of security resources. The main work is as follows: first, through the study of the current academic and market security manufacturers understanding of the understanding of SDS on the basis of further analysis of the structure and characteristics of SDS, Finally, a resource scheduling mechanism based on software definition security is proposed. Secondly, this paper designs a unified south API, security resource virtualization and load balancing scheduling algorithm, and implements a prototype system of resource scheduling mechanism based on software definition security. The effect of security resource scheduling mechanism is tested by a practical application.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】