面向云的软件定义防御体系研究

CLOUD-ORIENTED SOFTWARE DEFINED DEFENSE SYSTEM

随着云计算的发展,越来越多的传统应用迁移到云上,传统防御体系面对高度灵活的云服务,逐渐左支右绌,疲于应对。围绕云服务安全问题,结合云数据中心的现状,提出多层次细粒度的软件定义防御体系,支撑云服务用户安全弹性定制以及防御策略动态部署。在此体系架构下,进一步提出虚拟化防火墙设计,在数据平面上建立安全插件机制,为云服务用户的流量清洗等逻辑提供高速网络环境。实验结果证明了该体系的技术可行性,并且虚拟化防火墙设计能够满足高性能防御的需求。

With the development of cloud computing,more and more traditional applications are migrated to the cloud.Traditional defense systems are increasingly difficult to adapt to highly flexible cloud services.Around cloud service security,considering the development status of cloud data center,this paper proposes a multi-level,fine-grained software defined defense system to support flexible security customization as well as dynamic deployment of defense strategies.Under this architecture,the design of the virtualized firewall is further proposed,and a security plug-in mechanism is established in the data plane to provide high-speed network environment for cloud service users’traffic cleaning and other logic.The experimental results demonstrate the software defined defense system is technically feasible and the virtualized firewall design fulfills the needs of high-performance defense.