CN103746997A - Network security solution for cloud computing center - Google Patents

Abstract

The invention discloses a network security solution for a cloud computing center. By introducing a virtual switch and a virtual router, the network concept at the physical level is abstracted to a virtual level, and isolation and firewall network security functions are realized on the virtual network. The solution mainly includes : Build a layer-2 virtual network, divide subnets, deploy virtual routers, and define firewall rules. The present invention scientifically divides the network into public network pools and private network pools, and formulates deployment plans hierarchically according to different network classifications, thereby realizing the classification and layering of networks while more satisfying the flexible needs of customers manage. By introducing a virtual router, the physical network is abstracted to the virtual level, which effectively saves the usage of physical network IP, and uniformly transfers the management functions of the underlying network to the virtual router, so that network administrators can manage the entire system network directly by managing the virtual router. Configuration and service, management is easier and faster.

Description

A cloud computing center network security solution

technical field

The invention relates to the application field of cloud computing, in particular to a cloud computing center network security solution.

technical background

With the development of information technology, cloud computing has gradually become a hot spot in the industry, and cloud computing service platforms of major manufacturers at home and abroad have also begun to invest in science, education, culture, health, government, high-performance computing, e-commerce, and the Internet of Things. used in many fields.

An important feature of cloud computing is that through network technology, servers, storage, and network devices distributed in data centers around the world are assembled to work together through management software, and jointly provide computing and storage services to the outside world. In cloud data centers, a secure network environment is not only necessary, but has become a prerequisite for business success. Hacking, data tampering, and damage to the network environment will have a huge impact on the entire production and operation activities of the enterprise.

However, with the prevalence of destructive means such as computer viruses, hackers, and denial of service attacks, network security has gradually become a factor that enterprises must consider. How to protect the hardware, software and system data in the virtualized network environment from being destroyed, changed, or leaked due to accidental or malicious reasons while ensuring the efficiency of the network architecture itself has become a core issue that cloud computing vendors need to solve urgently .

In order to provide an appropriate security system and management plan, dynamically intercept or release network traffic, effectively reduce the impact of network security on network performance, and ensure that software and hardware in the cloud computing environment are not maliciously damaged, we propose an easy-to-expand, easy-to-use Development and easy-to-maintain network security solutions for cloud data centers.

Contents of the invention

The technical problem to be solved by the present invention is: the present invention proposes a cloud data center network security protection scheme based on a virtual router for the disadvantages of poor security and difficult management of the existing cloud data center network.

Traditional data centers generally adopt a network deployment solution that isolates networks through VLANs, connects subnets through physical routes, and filters traffic through physical firewalls. Although this solution guarantees the security of the customer's physical network environment to a certain extent, purchasing physical routers and firewalls will cost a considerable amount of money, and it is difficult to apply to cloud computing data centers centered on virtual machines, and it is impossible to conveniently control virtual machines. traffic between machines.

The traditional VNC open source program obtains the desktop of the virtual machine by directly connecting to the VNC port of the server, which has the following disadvantages:

1) Unable to traverse multiple network environments;

2) VNC data splitting cannot be realized, resulting in a large network bandwidth usage;

3) For VMware, Xen and other virtualization bottom layers, there are different degrees of double mouse phenomenon, and it is impossible to completely eliminate double mouse.

The technical scheme adopted in the present invention is:

A cloud computing center network security solution, through the introduction of virtual switches and virtual routers, abstracts the network concept at the physical level to the virtual level, implements network security functions such as isolation and firewalls on the virtual network, saves network costs, and has high scalability Sex, safety, compatibility, applicability, practicality. The solution mainly includes: building a layer-2 virtual network, dividing subnets, deploying virtual routers, and defining firewall rules, among which:

Building a layer-2 virtual network is the basis for the realization of the layer-2 network of the scheme. On the premise of physical network interoperability, the server NIC is abstracted into a virtual switch component to provide Layer 2 network services. It is developed based on the open source virtual switch Open vSwitch, and the physical NIC of each server is bound to a virtual switch one-to-one. Abstract to form a layer-2 virtual switch component; compatible with routers, switches, network cards and other physical network devices of major manufacturers, with high abstraction and applicability.

Dividing subnets is the basis for this solution to realize virtual network isolation. Through the subnet division method based on VLan and IP pool, the usage of physical network IP is effectively saved, the various network requirements of different customers are fully met, and the isolation between virtual subnets is realized; Layer virtual network ensures data separation between various services in the system, abstracts the complex physical network configuration process to the virtual layer, saves physical network IP usage, and simplifies the network configuration process;

Deploying a virtual router is the layer-3 network implementation link of this solution. By introducing a virtual router, the concept of the three-layer network at the physical level is abstracted to the virtual level, and the management functions of the underlying network are uniformly transferred to the virtual router, so that network administrators do not need to care about the specific distribution of the underlying network, and can manage it directly by managing the virtual router The configuration and service of the entire system network, the configuration is more flexible, the cost is lower, and the management is more convenient. The self-developed virtual router is used to provide three-layer network services (NAT, routing, DHCP), etc., to realize the interconnection and access control between virtual subnets, and to deploy scientifically, flexibly, efficiently and cost-effectively.

Defining firewall rules is the core of this program to achieve network security. By sending firewall control commands to the virtual router, the unified security management of the system network is realized. The virtual router used in this solution screens the connection according to the 5-tuple (source IP address, destination IP address, source port, destination port, protocol) And grouping, while ensuring the network performance of each subnet in the cloud data center, it also ensures the security of the system network;

Add firewall rules based on virtual routers, filter and group connections according to 5-tuples (source IP address, destination IP address, source port, destination port, protocol), and perform basic firewall protection on traffic between virtual machines; Dynamically protect applications during virtual machine migration, and can support many protocols (including FTP, RPC, TCP/IP protocols, etc.).

To build a Layer 2 virtual network, the deployment steps are as follows:

1) As shown in Figure 2, physical devices such as routers, switches, and firewalls are used to connect resources such as computing (servers) and storage (disk arrays) in the cloud data center to ensure that physical nodes, management nodes, and physical nodes, The network between nodes and storage can communicate with each other;

For cloud data centers with high network performance requirements, the system network can be physically divided into three types of networks: service network, control network, and data network (as shown in Figure 2) to ensure data separation among various services in the system.

2) Configure the virtual switch, that is, abstract the virtual switch components through the physical network card, as shown in Figure 3, through the software method based on Open vSwitch, bind the physical network card on each server with a virtual switch one-to-one to form a switch component, Virtualize several ports on the switch, each port is bound one-to-one to a network card of a virtual machine in the cloud data center. In this way, the network connection mode of virtual machine→virtual machine network card→virtual port→virtual switch→physical network card is realized ; Multiple virtual switches can be cascaded to form a large distributed virtual switch. Compared with the traditional physical switch, this kind of virtual switch has many advantages. First, the configuration is more flexible. The virtual switch abstracted from each physical network card can be flexibly configured with virtual ports, and the number of ports can be flexibly selected; second, the cost is lower. Inexpensive, through the virtual switch, you can often obtain the performance that can only be achieved by expensive physical switches; third, it is transparent to customers. Customers only need to configure the network card of the virtual machine to realize the automatic connection of the virtual machine network, and do not need to care about the underlying virtual network equipment. connection method.

The division of subnets divides the virtual network into two categories according to different network connection methods and isolation methods, so as to meet the network needs of different customers:

1) Public network pool: as shown in Figure 4, the public network pool corresponds to the virtual port group directly connected to the public network on the virtual switch, and the virtual machine uses an IP that can access the public network;

2) Private network pool: As shown in Figure 5, the private network pool corresponds to the virtual port group of the VLan set on the virtual switch. The virtual machine uses the private network IP under a specific Vlan, and can only communicate within the LAN range, and cannot access the public network.

The deployment of the virtual router, by introducing the virtual router, as shown in Figure 6, creates a system virtual machine separately, adds the routing core service, management service and SSH interactive service in it, and uniformly encapsulates it in the form of a virtual router, and sets two virtual routers Network card, respectively connect the port of the private network virtual switch and the port of the public network virtual switch, and set the private network and public network IP to ensure that the virtual router can communicate with the public network and private network; the private network IP of the virtual router (such as 192.168.6.254 ), which is the gateway of the connected private network virtual switch, all virtual machines connected to the private network virtual switch, by setting the private network IP (such as 192.168.6.254) of the virtual router as its own gateway, the virtual router can realize For the management of the virtual machine network, the virtual router is provided in the form of a virtual machine template (ovf format), which is convenient for rapid deployment; various networks are connected through virtual routing. As shown in Figure 7, the virtual machine uses the private network IP, and performs NAT and routing processing through the virtual router to realize the interconnection with the public network or isolated subnet. Because the network in the system is a virtual concept, it effectively saves unnecessary IP usage in the system.

The above-mentioned definition of firewall rules is the core link of this solution to realize network security. Since the virtual machine gateways of all private network pools are set to the private network card IP of the virtual router, all external networks (different network segment or different vlan network) traffic must pass through the virtual router first, and then flow into the virtual machine; similarly, all intranet traffic must first pass through the virtual router before reaching the external network (different network segment or different vlan network), Figure 7. Therefore, by adding firewall rules to the virtual router, the flow of mutual access between different networks can be controlled.

As shown in Figure 8, the virtualized network environment is nothing more than divided into three categories: public area, private area, and isolated area. Access between different regions and different network segments in the same region can be restricted by adding firewall rules.

The firewall rules include:

1) Packet filtering: source IP filtering, source IP and destination IP filtering, source IP and destination protocol filtering, source MAC address filtering, etc.;

2) Network filtering: through URL filtering, content classification filtering, keyword filtering, etc.;

3) Intrusion prevention: IPS, etc.

Note: Intrusion Protection (Prevention) System (IPS) is a new generation of Intrusion Detection System (IDS), which can make up for the weaknesses of IDS in terms of proactiveness and false positive/negative properties. IPS can identify the intrusion, correlation, impact, direction and appropriate analysis of an event, and then transmit appropriate information and commands to firewalls, switches and other network devices to mitigate the risk of the event.

Network Address Translation (NAT, Network Address Translation) is a wide area network (WAN) access technology. It is a conversion technology that converts private (reserved) addresses into legal IP addresses. It is widely used in various types of Internet access methods and various types of networks.

The beneficial effects of the present invention are:

1. Through in-depth research on the network needs of customers, the network is scientifically divided into two categories: public network pools and private network pools, and according to different network classifications, the deployment plan is formulated hierarchically, while more meeting the flexible needs of customers, to achieve The classification and hierarchical management of the network make the deployment more scientific, concise and easy to manage.

2. By introducing the self-developed virtual router, the physical network is abstracted to the virtual level. On the one hand, it effectively saves the usage of physical network IP; on the other hand, it transfers the management functions of the underlying network to the virtual router. You don't need to care about the specific distribution of the underlying network, you can manage the configuration and services of the entire system network directly by managing the virtual router, making management easier and faster.

3. Add firewall rules based on the layer-3 virtual router, filter and group connections according to 5-tuples (source IP address, destination IP address, source port, destination port, protocol), and basically control the traffic between virtual machines The firewall protection greatly enhances the network security in the cloud computing environment.

Description of drawings

Fig. 1 is the realization flow schematic diagram of the present invention;

Figure 2 is a basic network environment diagram;

Fig. 3 is a logical schematic diagram of a virtual switch;

Figure 4 is a schematic diagram of a public network pool;

Fig. 5 is a schematic diagram of a private network pool;

FIG. 6 is a compositional architecture diagram of a virtual router;

Fig. 7 is a schematic diagram of a virtual routing network;

FIG. 8 is a schematic diagram of traffic isolation by a firewall.

Detailed ways

Below with reference to accompanying drawing, the present invention is further described by specific embodiment:

The system structure of the present invention mainly includes: building a two-layer virtual network, dividing subnets, deploying virtual routers, and defining firewall rules.

Among them, building a layer-2 virtual network is the basis for implementing the layer-2 network of this solution. The deployment steps are as follows:

1) As shown in Figure 2, physical devices such as routers, switches, and firewalls are used to connect resources such as computing (servers) and storage (disk arrays) in the cloud data center to ensure that physical nodes, management nodes, and physical nodes, The network between nodes and storage can communicate with each other. For cloud data centers with high network performance requirements, the system network can be physically divided into three types of networks: service network, control network, and data network (as shown in Figure 2) to ensure data separation among various services in the system.

2) Configure the virtual switch, that is, abstract the virtual switch components through the physical network card. As shown in Figure 3, through the software method based on Open vSwitch, the physical network card on each server is bound to a virtual switch one-to-one to form a switch component. Several ports are virtualized on the switch, and each port is bound one-to-one to a network card of a virtual machine in the cloud data center. In this way, the network connection mode of virtual machine→virtual machine network card→virtual port→virtual switch→physical network card is realized. Multiple virtual switches can be cascaded to form a large distributed virtual switch. Compared with the traditional physical switch, this kind of virtual switch has many advantages. First, the configuration is more flexible. The virtual switch abstracted from each physical network card can be flexibly configured with virtual ports, and the number of ports can be flexibly selected; second, the cost is lower. Inexpensive, through the virtual switch, you can often obtain the performance that can only be achieved by expensive physical switches; third, it is transparent to customers. Customers only need to configure the network card of the virtual machine to realize the automatic connection of the virtual machine network, and do not need to care about the underlying virtual network equipment. connection method.

Dividing subnets is the basis for implementing virtual network isolation in this solution. According to different network connection methods and isolation methods, the virtual network is divided into two categories to meet the network needs of different customers:

1) Public network pool: As shown in Figure 4, the public network pool corresponds to the virtual port group directly connected to the public network on the virtual switch, and the virtual machine uses an IP that can access the public network.

2) Private network pool: As shown in Figure 5, the private network pool corresponds to the virtual port group of the VLan set on the virtual switch. The virtual machine uses the private network IP under a specific Vlan, and can only communicate within the LAN range, and cannot access the public network.

Deploying a virtual router is the layer-3 network implementation link of this solution. Introduce a self-developed virtual router, as shown in Figure 6, create a system virtual machine separately, add routing core services, management services, and SSH interactive services to it, and uniformly encapsulate it in the form of a virtual router. Set up two network cards for the virtual router, respectively connect the port of the private network virtual switch and the port of the public network virtual switch, and set the private network and public network IP to ensure that the virtual router can communicate with the public network and private network. The private network IP (such as 192.168.6.254) of the virtual router is the gateway of the connected private network virtual switch. All virtual machines connected to the private network virtual switch can realize the management of the virtual machine network by the virtual router by setting the private network IP (such as 192.168.6.254) of the virtual router as its own gateway. The virtual router is provided in the form of a virtual machine template (ovf format), which facilitates rapid deployment.

Connect various networks through virtual routers. As shown in Figure 7, the virtual machine uses the private network IP, and performs NAT and routing processing through the virtual router to realize the interconnection with the public network or isolated subnet. Because the network in the system is a virtual concept, it effectively saves unnecessary IP usage in the system.

Defining firewall rules is the core of this solution to achieve network security. Since the virtual machine gateways of all private network pools are set to the private network card IP of the virtual router, all external networks (different network segment or different vlan network) traffic must first pass through the virtual router, and then flow into the virtual machine; similarly, all intranet traffic must first pass through the virtual router before reaching the external network (different network segment or different vlan network), Figure 7. Therefore, by adding firewall rules to the virtual router, the flow of mutual access between different networks can be controlled.

As shown in Figure 8, the virtualized network environment is nothing more than divided into three categories: public area, private area, and isolated area. Access between different regions and different network segments in the same region can be restricted by adding firewall rules. Specific firewall rules include:

1) Packet filtering: source IP filtering, source IP and destination IP filtering, source IP and destination protocol filtering, source MAC address filtering, etc.;

2) Network filtering: through URL filtering, content classification filtering, keyword filtering, etc.;

Intrusion prevention: IPS, etc.

Claims (6)

1. A cloud computing center network security solution, characterized in that: by introducing virtual switches and virtual routers, abstracting the network concept at the physical level to the virtual level, and realizing isolation and firewall network security functions on the virtual network, the solution It mainly includes: building a layer-2 virtual network, dividing subnets, deploying virtual routers, and defining firewall rules, among which: Build a layer-2 virtual network. Under the premise of physical network interoperability, the server network card is abstracted into a virtual switch component to provide layer-2 network services. Based on the open source virtual switch Open vSwitch, the physical network card of each server is connected to a virtual switch. One-to-one binding, abstract to form a layer 2 virtual switch component; Divide the subnet, through the subnet division method based on VLan and IP pool, effectively save the usage of physical network IP, fully meet the various network needs of different customers, and realize the isolation between virtual subnets; through the virtual switch Divide the two-layer virtual network with VLan to ensure the data separation between various services in the system, abstract the complex physical network configuration process to the virtual level, save the physical network IP usage, and simplify the network configuration process; Deploy a virtual router. By introducing a virtual router, the concept of the three-layer network at the physical level is abstracted to the virtual level, and the management functions of the underlying network are uniformly transferred to the virtual router, so that network administrators do not need to care about the specific distribution of the underlying network. The router can manage the configuration and service of the entire system network. The self-developed virtual router is used to provide NAT, routing, and DHCP three-layer network services to realize the interconnection and access control between virtual subnets; Define firewall rules, and realize unified security management of the system network by sending firewall control commands to the virtual router. The virtual router used in this solution connects according to the source IP address, destination IP address, source port, destination port, and protocol 5-tuple Perform screening and grouping to ensure the security of the system network while ensuring the network performance of each subnet in the cloud data center; Add firewall rules based on the virtual router, filter and group connections according to the source IP address, destination IP address, source port, destination port, and protocol 5-tuple, and perform basic firewall protection on the traffic between virtual machines. 2. A kind of cloud computing center network security solution according to claim 1, characterized in that: said building a two-layer virtual network, the deployment steps are as follows: 1) Use routers, switches, and firewall physical devices to connect computing and storage resources in the cloud data center to ensure network communication between physical nodes, between management nodes and physical nodes, and between nodes and storage; 2) Configure the virtual switch, abstract the virtual switch components through the physical network card, and bind the physical network card on each server with a virtual switch one-to-one through the software method based on Open vSwitch to form a switch component, and virtualize several on the switch Each port is bound one-to-one to a network card of a virtual machine in the cloud data center. In this way, the network connection mode of virtual machine→virtual machine network card→virtual port→virtual switch→physical network card is realized; multiple virtual switches It can be cascaded to form a large distributed virtual switch. 3. A kind of cloud computing center network security solution according to claim 1 or 2, characterized in that: the subnetwork is divided into two categories according to different network connection modes and isolation means: 1) Public network pool: The public network pool corresponds to the virtual port group directly connected to the public network on the virtual switch, and the virtual machine uses an IP that can access the public network; 2) Private network pool: The private network pool corresponds to the virtual port group of the VLan set on the virtual switch. The virtual machine uses the private network IP under the specific Vlan, and can only communicate within the range of the LAN, and cannot access the public network. 4. A kind of cloud computing center network security solution according to claim 3, it is characterized in that: described deployment virtual router, by introducing virtual router, create a system virtual machine separately, add routing core service, management service therein Interactive service with SSH, uniformly packaged into the form of a virtual router, set two network cards for the virtual router, respectively connect the port of the private network virtual switch and the port of the public network virtual switch, and set the private network and public network IP to ensure that the virtual router can It is connected to the public network and private network; the private network IP of the virtual router is the gateway of the connected private network virtual switch, and all virtual machines connected to the private network virtual switch can set the private network IP of the virtual router as their own The gateway realizes the management of the virtual machine network by the virtual router. The virtual router is provided in the form of a virtual machine template, which is convenient for rapid deployment; through the virtual router, various types of networks are connected, and the virtual machine uses the private network IP through the virtual router. NAT and routing processing to realize the interconnection with the public network or isolated subnets. 5. A cloud computing center network security solution according to claim 4, characterized in that: by adding firewall rules in the virtual router, the flow of mutual visits between different networks is controlled. 6. A kind of cloud computing center network security solution according to claim 5, is characterized in that: described firewall rule comprises: 1) Packet filtering: source IP filtering, source IP and destination IP filtering, source IP and destination protocol filtering, source MAC address filtering, etc.; 2) Network filtering: through URL filtering, content classification filtering, keyword filtering, etc.; 3) Intrusion prevention.

Images