为了解决传统网络无法适应未来网络发展需要的问题,引入网络切片(network slice,NS)技术.基于软件定义网络(software defined network,SDN)和可信计算技术提出软件定义可信(software defined trust,SDT)的思想.针对Openv Switch(OVS)和O...为了解决传统网络无法适应未来网络发展需要的问题,引入网络切片(network slice,NS)技术.基于软件定义网络(software defined network,SDN)和可信计算技术提出软件定义可信(software defined trust,SDT)的思想.针对Openv Switch(OVS)和Open Daylight中的虚拟租赁网络(virtual tenant network,VTN)技术,设计一种基于SDT的网络切片模型:在用户请求资源时,对转发层的交换机进行可信性的采集,并针对不同的用户需求构造相应的可信切片;在切片运行过程中,对切片进行可信监控,提出OVS回退与流表恢复的方法对不可信的切片进行恢复.经实验验证,该方法在保障切片可信性的同时,提高了资源利用率与切片恢复的效率.展开更多
A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile...A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used n a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet nspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for ntelligence flow processing to protect from possible network attacks inside a data center network展开更多
介绍云平台安全整体架构设计,针对多租户虚拟网络环境下租户与租户之间、租户内部和租户对外访问等多种安全访问需求,围绕云网络安全设计具体说明虚拟扩展局域网(Virtual Extensible Local Area Network,VXLAN)、安全组、虚拟防火墙等...介绍云平台安全整体架构设计,针对多租户虚拟网络环境下租户与租户之间、租户内部和租户对外访问等多种安全访问需求,围绕云网络安全设计具体说明虚拟扩展局域网(Virtual Extensible Local Area Network,VXLAN)、安全组、虚拟防火墙等方面的安全防护技术,重点探讨分布式虚拟防火墙和安全虚拟组件两种安全防护系统的特点与优势,为云平台安全防护提供新的思路和解决方案。展开更多
文摘为了解决传统网络无法适应未来网络发展需要的问题,引入网络切片(network slice,NS)技术.基于软件定义网络(software defined network,SDN)和可信计算技术提出软件定义可信(software defined trust,SDT)的思想.针对Openv Switch(OVS)和Open Daylight中的虚拟租赁网络(virtual tenant network,VTN)技术,设计一种基于SDT的网络切片模型:在用户请求资源时,对转发层的交换机进行可信性的采集,并针对不同的用户需求构造相应的可信切片;在切片运行过程中,对切片进行可信监控,提出OVS回退与流表恢复的方法对不可信的切片进行恢复.经实验验证,该方法在保障切片可信性的同时,提高了资源利用率与切片恢复的效率.
基金supported in part by the National Key Basic Research and Development(973)Program of China(Nos.2013CB228206 and 2012CB315801)the National Natural Science Foundation of China(Nos.61233016 and 61140320)+1 种基金supported by the Intel Research Council with the title of "Security Vulnerability Analysis based on Cloud Platform with Intel IA Architecture"Huawei Corp
文摘A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used n a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet nspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for ntelligence flow processing to protect from possible network attacks inside a data center network
文摘介绍云平台安全整体架构设计,针对多租户虚拟网络环境下租户与租户之间、租户内部和租户对外访问等多种安全访问需求,围绕云网络安全设计具体说明虚拟扩展局域网(Virtual Extensible Local Area Network,VXLAN)、安全组、虚拟防火墙等方面的安全防护技术,重点探讨分布式虚拟防火墙和安全虚拟组件两种安全防护系统的特点与优势,为云平台安全防护提供新的思路和解决方案。
