软件定义的弹性安全云平台

1、软件定义的弹性安全云Software Defined-Security Fabric软件定义安全架构SDS Architecture软件定义数据中心SDN安全研究软件定义安全架构01SDDC：Network management is painUnmatchCLI，SerialWEB portalDistributed Network ManagementPerl, ExpectDistributed Compute& Storage ManagementPuppetHadoop, Storm软件定义计算、存储、网络 vs 安全Openflow handling systemSpecial p

2、acket forwarding hardwareOpenflow SwitchAPPNetwork controllerAPPAPPOpenflow handling systemSpecial packet forwarding hardwareOpenflow SwitchOpenflow handling systemSpecial packet forwarding hardwareOpenflow SwitchOpenflow handling systemSpecial packet forwarding hardwareOpenflow SwitchSDN是未来网络的希望之路安

3、全呢？！能否在SDN网络中部署现有的安全产品？能否使用软件定义的理念重构我们的安全解决方案？SDN安全的相关工作Flow-level security Lightweight DDoS ooding attack detection using NOX/OpenFlow 2Source address validation solution with OpenFlow/NOX architecture 3 Packet-level securityFleXam, a flexible sampling OpenFlow extension 4 ArchitectureFRESCO1Defens

4、e4All in Opendaylight, radware当前SDN安全架构案例Defense4AllFresco形式化的当前SDN安全架构 Network ControllerNetwork deviceCommandSecurity DeviceDataRequestSecurity KernelDataSecurity DeviceSecurity DeviceData flowDataThe SDSA Architecture ISecurity ControllerNetwork ControllerNetwork deviceCommandsSecurity DeviceData

5、RequestStatusReportsAlertsCommandsSecAgentData, TopologyStatsDataSecurity DeviceSecurity DeviceData flowsPoliciesNetwork AppSec AppinputinputoutputoutputThe SDSA Architecture IISecurity ControllerNetwork ControllerNetwork deviceCommandsSecurity DeviceDataRequestStatusReportsAlertsCommandsSecAgentDat

6、a, TopologyStatsDataSecurity DeviceSecurity DeviceData flowsPoliciesNetwork AppSec AppSec AppSec AppSec eventscommandsinputoutputIaaS NVTenantInfoSDS Architecture(SDSA) with Cloud/SDN安全控制平台IPS基础设施管理平台APP1APP2APPn服务编排设备资源池库对接运营平台APPiAPP1应用商店客户环境IPSIPSWAWAFWAFFWFWFWInternet安全资源池SDN控制器对接Redesign of Sec

7、urity ApplianceAPPAPPOperating SystemSpecial packet forwarding hardwareSecurity deviceAPPSecurity rulehandling systemSpecial packet forwarding hardwareSD-security device策略日志、告警策略规则安全设备判断逻辑计算决策层数据数据规则库决策逻辑Orchestration 控制层反馈知识库信誉库安全状态机APPAPPPortal策略管理安全分析改变了安全应用的交付模式加快了安全应急响应的速度安全应用商店NSFOCUS Security

8、 APP StoreSecurity ControllerCompany AServerAPPAPPAuthenticationPurchaseUpdateDeploy, updateServerAPPAPPSecurity ControllerCompany BServerAPPAPPDeploy, updateServerAPPAPP新型网络中安全机制的部署研究Security Deployment in Novel Network微分段服务链02微分段 Microsegmentation云环境中东西向的攻击示意图基于传统安全域的访问控制机制服务链II安全控制平台SDN控制器云计算控制节点

9、计算节点hypervisorVM1VMVM3vswitch网络接口计算节点hypervisorvswitch输出口输入口Rack交换机VM2VMVMOpenflow指令流量调度指令服务链II安全控制平台SDN控制器云计算控制节点计算节点hypervisorVM1IPSvswitch网卡计算节点hypervisorvswitch输出网卡输入网卡Rack交换机VM2VMVMOpenflow指令流量调度指令WAF1种逻辑结构=n种物理形态 资源池化Security AgentVFWVIPSFWvsysEngineSecurity AgentVFWVWAFFWOverlay NetworkPhysic

10、al NetworkFWvsys安全控制平台HighAvailabilityFailure RecoveryScalabilityService ChainLoad BalanceAPPAPPAPPSecurity Fabric实现南北向服务链SDN控制器安全节点安全控制平台Openflow指令vswitch输入网卡输出网卡IPSWAFFWvswitch输入网卡输出网卡IPSWAFIPSvswitch输入网卡输出网卡IPSWAFFW安全节点Security Fabric数据中心入口云系统入口Overlay Networkagentagentagent服务链II安全控制平台SDN控制器云计算控制

11、节点计算节点hypervisorVM1VM2VM3vswitch网口安全节点hypervisorvswitch输出口输入口Rack交换机IPSFWWAFOpenflow指令云系统流量调度指令SDN控制器资源池内部流量调度指令软件定义安全体系在云环境的应用SDSA use cases in Clouds云环境中的Web安全防护03 Case：Live protection for Openstack web serversWAFInternetweb集群Security ControllerSDNControllerautomationorchestrationRewrite pkgdestin

12、ation to WAFLaunch instancesPush commandsWAFWAFDemo：WAF VM+Openstack+SDN controllerHR WebHR DBERP WebERP DB管理管理管理域HR维护租户ERP维护租户官网Web官网DB官网维护租户使用服务链+微分段技术的云计算Web安全服务绿盟科技云安全解决方案NSFOCUS Cloud Security Solution云安全解决方案集成情况产品虚拟化情况04软件定义安全架构VFWVIPSFWFWVSwitchCompute nodeVFWVIPSTunnelVM安全硬件设备 VSwitchNetDevI

13、nternetSDS controllerAPIsOperating CenterAnti-APT APPACL APP绿盟云MSS/SaaS/APPStoreorchestrationResource poolsKnowledge DBBSAESPCLogsAPIsAPPsvIPSIPSIPSWAvWAFWAFFWvFWFWoverlayFacilitiesSwitchSwitchSwitchvSwitchvSwitchVMVMVMVMVMVMControlSDN controllerTE APPSec APPResourcesIaaS platformSolution Architecture 私有云安全解决方案（Private cloud security solution）MSS&SaaSOnsite ServiceUser/Admin Dashboard 产品虚拟化（Virtualized products） ProductsVirtualization Pl