CN107682203B

CN107682203B - Security function deployment method based on service chain

Info

Publication number: CN107682203B
Application number: CN201711041932.0A
Authority: CN
Inventors: 于冰; 于然; 曾颖明; 王斌; 刘滋润; 姚金利; 郭敏
Original assignee: Beijing Institute of Computer Technology and Applications
Current assignee: Beijing Institute of Computer Technology and Applications
Priority date: 2017-10-30
Filing date: 2017-10-30
Publication date: 2020-09-08
Anticipated expiration: 2037-10-30
Also published as: CN107682203A

Abstract

The invention relates to a safety function deployment method based on a service chain, relating to the technical field of network safety. The invention provides a method for deploying a safety function service chain aiming at the safety service requirement of a user and the safety service chain arranged and issued by an upper layer, reasonably maps a plurality of safety service chains which arrive at the same time, reduces the network cost on the premise of meeting the functional requirement and the bandwidth requirement, and ensures the service quality.

Description

Security function deployment method based on service chain

Technical Field

The invention relates to the technical field of network security, in particular to a security function deployment method based on a service chain.

Background

Software Defined Networking (SDN), as an emerging network technology in recent years, brings new opportunities and challenges to network management. The basic idea is to separate network control and data forwarding from each other, and decouple the network control function and the data forwarding function. And a programming mode is adopted to realize a centralized management control function, so that the complexity of network management is simplified, and the development and innovation of the network are promoted. Fig. 1 depicts a three-level logical architecture diagram of an SDN, from top to bottom: an application layer, a control layer, and an infrastructure layer.

The SDN framework can flexibly compile various application services in an application layer through a programmable interface API of a control layer, and meets the differentiated and diversified application requirements of multiple tenants. The control layer located in the middle of the whole architecture is responsible for maintaining the global network topology, making a centralized scheduling strategy and issuing the scheduling strategy to the network equipment in the infrastructure layer through the southbound interface. The infrastructure layer at the bottom layer only needs to receive various instructions of the SDN control layer through a southbound interface (such as OpenFlow) to complete simple data processing and forwarding.

The SDN separates a control plane from a data plane, so that the complexity of hardware equipment can be reduced, and a centralized control method is adopted to facilitate the unified management of network equipment. In addition, global information of the network is mastered by the SDN controller, a more intelligent scheduling strategy can be formulated, and the network state can be better mastered and more quickly adjusted, so that the resource utilization efficiency is improved, the network management is simplified, and the network energy consumption cost is reduced. The rise of the SDN technology opens up a new implementation approach for resource management and load balancing based on a global network view.

Network Function Virtualization (NFV) technology extracts Network functions on traditional professional Network element devices, and runs on a general hardware platform in a virtualized and software form. The flexible loading, the deployment as required and the updating of the software network function are realized, the remote management and the maintenance are greatly convenient, and the Capital Expenditure (CAPEX) and the operation cost (OPEX) of a service provider are reduced.

The NFV technology establishes a one-to-one mapping relationship between computing resources, storage resources, and Network resources such as servers, storage devices, switches, and routers, and corresponding Virtual Network Functions (VNFs), so as to form a Virtual computing resource component, a Virtual storage resource component, a Virtual Network resource component, and the like. The invention mainly researches a virtual security resource component, which comprises: a virtual Network Address Translation (vNAT), a virtual FireWall (vFW), a virtual Intrusion Detection System (vfds), a virtual Intrusion Prevention System (vIPS), and the like, as shown in fig. 2.

With the continuous development of SDN technology and NFV technology, network control becomes more flexible and more extensible. SDN virtualizes and logically abstracts the underlying physical network by controlling forwarding separation, and guides forwarding traffic to automatically pass through virtual service nodes through an SDN controller, so that a flexible, convenient, and efficient service function can be implemented, and a sequence formed by such traffic passing through virtual service function nodes in sequence is referred to as a service chain, as shown in fig. 3.

Therefore, for the security service requirement of the user and the security service chain arranged and issued by the upper layer, an optimal path meeting the security service capability, the security function sequence and the resource requirement needs to be selected, which is a problem of the security function deployment (or referred to as a mapping problem) based on the service chain, as shown in fig. 4.

Disclosure of Invention

Technical problem to be solved

The technical problem to be solved by the invention is as follows: a method for deploying a security function service chain is provided for the security service requirements of users and the security service chain arranged and issued by an upper layer. (II) technical scheme

In order to solve the technical problem, the invention provides a service chain-based security function deployment method, which comprises the following steps:

first, the underlying network topology is represented by a weighted graph G_S＝(V_S,E_S) In which V is_SIs a physical node set composed of forwarding nodes and safety function nodes, V_S＝T_S∪N_S，T_SSet of resource forwarding nodes, N, representing routes, etc_SFor a set of security function nodes, e.g. firewalls_SIs a set of links in the physical network,

presence attribute bandwidth capability, including link e_sUplink bandwidth capacity of B (e)_s↑) And a downlink bandwidth capacity B (e)_s↓)，e_s＝(v_i,v_j)，v_iAnd v_jFor link e_sThe two end points of (a) are,

if i<j, then is called by v_iFlow direction v_jThe flow of (1) is uplink flow, the reverse is downlink flow, and the hop count hop (v)_i,v_j) Denotes v_iAnd v_jThe transmission delay therebetween;

secondly, defining the set of R service chain requests arriving at the same time as phi ═ Q₁,Q₂,…,Q_RTherein service chaining requests

Represented as a directed sequence Q_r＝(q_r,1,q_r,2,…,q_r,h-1,q_r,h,q_r,h+1,…,q_r,H) Contains a total of H safety function requirements, q of which_r,h-1Is q_r,hThe previous safety function requirement of q_r,h+1Is q_r,hThe latter safety function requirement of, from q_r,hTo q_r,h+1Is denoted as link (q)_r,h,q_r,h+1) The corresponding bandwidth is denoted bw (q)_r,h,q_r,h+1)；

Thirdly, defining N_r(q_r,h) Representing a chain of deployment services Q_rMedium safety function requirement q_r,hPhysical node of, N_r(q_r,h)∈N_SEach security function requirement in the service chain can be deployed on only one physical security function node, using L_r(q_r,h,q_r,h+1) Representing a service chain Q_rMedium safety function requirement q_r,hTo q_r,h+1The traffic path therebetween, i.e. the link (q)_r,h,q_r,h+1) At G_SThe deployment path on, defining the network cost generated by service chain deployment as:

and fourthly, in the service chain deployment process, dividing the deployment problem of each service chain into smaller sub-service chain deployment problems by adopting a divide-and-conquer method.

Preferably, in the fourth step, the division basis is: for service chain Q_rSafety function requirement q in (1)_r,hIf in the underlying topology G_SIn which only a single safety function existsEnergy node v_iCan provide q_r,hFunctional requirement, i.e. functional requirement q_r,hV can and can only be deployed on nodes_iThen the function requirement q is set_r,hDeployed at node v_iTo above, i.e. N_r(q_r,h)＝v_iAnd with q_r,hPartitioning service chains Q for boundaries_rAnd forming a sub-service chain, deploying the divided sub-service chains in sequence, and connecting the obtained deployment result of the sub-service chains and the routing result in sequence to obtain the deployment result of the service chain.

Preferably, in the fourth step, for each sub-service chain, the communication links are sorted according to the bandwidth requirement, and the links are deployed in sequence according to the order.

Preferably, in the fourth step, for each sub-service chain, the communication links are sorted according to the bandwidth requirement, and the deploying the links in sequence according to the order specifically includes:

if the link (q)_r,h,q_r,h+1) Of the two ends of (a) of (b) of_r,hAnd q is_r,h+1None deployed, then mark link (q)_r,h,q_r,h+1) The flow is in an undetermined state, and the next flow is deployed; if the link (q)_r,h,q_r,h+1) Has been successfully deployed, link (q) is established to the link_r,h,q_r,h+1) Deployment is performed, link (q) is selected_r,h,q_r,h+1) If the other endpoint q is not yet deployed_r,hBoth the former and latter security functions of (a) are deployed, then according to the endpoint q_r,hPrevious safety function requirement q_r,h－1And the latter safety function requirement q_r,h+1At G_sCan provide q_r,hAmong the candidate nodes of the function, the link (q) satisfying the selection_r,h,q_r,h+1) And link (q)_r,h－1,q_r,h) Taking a safety function physical node with two-section link bandwidth requirement and minimum two-section link network cost as q_r,hThe deployment node of (2); if q is_r,hThe former or latter security function of (a) is not deployed, and q can be provided_r,hSelecting all candidate physical nodes of the function to satisfy link (q)_r,h,q_r,h+1) Bandwidth required, network cost bestSmall nodes and links are allocated and Q is determined_rThrough function q_r,hAnother link (q) of_r,h－1,q_r,h) Whether or not it is in a pending state, if the link is link (q)_r,h－1,q_r,h) In pending state, link (q) is mapped using the same method_r,h－1,q_r,h) And the end point thereof is deployed and continuously judges to pass through the function q_r,h－1Whether the unallocated link is in a pending state; if the link (q)_r,h－1,q_r,h) If not, the next link is deployed according to the sequence obtained by the bandwidth requirement sequencing until the service chain Q_rAll the function requirements and link requirements in the system are deployed and completed; if in the process of deployment, G_sThe service chain fails to be deployed if it cannot provide the security functions required by the service chain or cannot meet the bandwidth requirements of the service chain.

(III) advantageous effects

The invention provides a method for deploying a safety function service chain aiming at the safety service requirement of a user and the safety service chain arranged and issued by an upper layer, reasonably maps a plurality of safety service chains which arrive at the same time, reduces the network cost on the premise of meeting the functional requirement and the bandwidth requirement, and ensures the service quality.

Drawings

Figure 1 is a typical architecture diagram for an SDN;

FIG. 2 is a diagram of a NAT implementation virtual secure resource component;

FIG. 3 is a schematic diagram of a service chain;

FIG. 4 is a schematic diagram of a service chain-based security function deployment, where a is an underlying security function network topology diagram and b is a schematic diagram of a security function service chain;

FIG. 5 is an exemplary diagram of an underlying network topology and service chaining requests; wherein a is an underlying network topology map, and b is a service chain request schematic diagram;

fig. 6 is an exemplary diagram of a service chain deployment result.

Detailed Description

In order to make the objects, contents, and advantages of the present invention clearer, the following detailed description of the embodiments of the present invention will be made in conjunction with the accompanying drawings and examples.

A Security Service Function Chain (SSFC) is a group of ordered Security Function sets, and traffic sequentially passes through a plurality of Security Function nodes according to a specified policy to form a Security Service with a specified Function and sequence. Since each security function may be distributed with multiple security function components in the network, the deployment process of the security function service chain is the selection of the security function components and the routing process between them.

The invention provides a method for deploying a safety function service chain, which reasonably maps a plurality of safety service chains which arrive at the same time, reduces the network cost on the premise of meeting the functional requirements and bandwidth requirements, and ensures the service quality. The method comprises the following steps:

first, the underlying network topology is represented by a weighted graph G_S＝(V_S,E_S) In which V is_SIs a physical node set composed of forwarding nodes and safety function nodes, V_S＝T_S∪N_S。T_SSet of resource forwarding nodes, N, representing routes, etc_SThe method is a set of security function nodes such as a firewall. E_SIs a set of links in the physical network,

presence attribute bandwidth capability, including link e_sUplink bandwidth capacity of B (e)_s↑) And a downlink bandwidth capacity B (e)_s↓)。e_s＝(v_i,v_j)，v_iAnd v_jFor link e_sTwo end points of (a).

If i<j, then is called by v_iFlow direction v_jThe flow of (1) is uplink flow, and the reverse is downlink flow. Hop count hop (v)_i,v_j) Denotes v_iAnd v_jThe transmission delay therebetween. For example, in FIG. 5(a), the underlying network topology G_SComprising a total of 14 physical nodes, i.e. V_S＝{v₁,v₂,v₃,v₄,v₅,v₆,v₇,v₈,v₉,v₁₀,v₁₁,v₁₂,v₁₃,v₁₄}. Wherein the set of security function nodes N_SAnd a set of forwarding nodes T_SAre respectively N_S＝{v₁,v₂,v₃,v₅,v₆,v₁₀,v₁₁,v₁₃}、T_S＝{v₄,v₇,v₈,v₉,v₁₂,v₁₄}. The number next to each link represents the bandwidth (or bandwidth capacity) of the link, with the left side of the "/" being the upstream bandwidth capacity and the right side being the downstream bandwidth capacity. Link (v) in FIG. 5(a)₁,v₂) Has an upstream bandwidth capacity of 8Mbps and a downstream bandwidth capacity of 10Mbps, i.e., B ((v)₁,v₂)_↑)＝8Mbps，B((v₁,v₂)_↓)＝10Mbps，v₁And v₂Hop count hop (v) in between₁,v₂)＝1。

Next, a set of R service chain requests arriving at the same time is defined as Φ ═ Q₁,Q₂,…,Q_RTherein service chaining requests

Represented as a directed sequence Q_r＝(q_r,1,q_r,2,…,q_r,h-1,q_r,h,q_r,h+1,…,q_r,H) And the system comprises H safety function requirements. Wherein q is_r,h-1Is q_r,hThe previous safety function requirement of q_r,h+1Is q_r,hThe latter safety function requirement of, from q_r,hTo q_r,h+1Is denoted as link (q)_r,h,q_r,h+1) The corresponding bandwidth is denoted bw (q)_r,h,q_r,h+1). Service chain request set Φ ═ { Q) as shown in fig. 5(b)₁,Q₂,Q₃In which Q₁＝(FW,IDS,NAT)，Q₂＝(NAT,LB,IPS)，Q₃(IDS, IPS, FW, NAT, LB). With Q₁For example, Q₁Contains 3 safety function requirements, and is sequentially a Firewall (FW)FW is the previous security function requirement of the IDS, Intrusion Detection (IDS) and Network Address Translation (NAT) is the latter security function requirement of the IDS. Bandwidth requirement bw (FW, IDS) corresponding to the link (FW, IDS) from the FW function to the IDS function is 4Mbps, and bandwidth requirement bw (IDS, NAT) corresponding to the link (IDS, NAT) from the IDS function to the NAT function is 3 Mbps. In the service chain deployment process, the in-sequence arrangement of the security functions and the bandwidth requirements among the security functions are both satisfied.

Thus, the service chain Q_rCan be regarded as that all safety function requirements and communication traffic between them are in the underlying network G_SThe deployment problem. The third step defines N_r(q_r,h) Representing a chain of deployment services Q_rMedium safety function requirement q_r,hPhysical node of, N_r(q_r,h)∈N_SEach security function requirement in the service chain can and cannot only be deployed on one physical security function node. Using L_r(q_r,h,q_r,h+1) Representing a service chain Q_rMedium safety function requirement q_r,hTo q_r,h+1The traffic path therebetween, i.e. the link (q)_r,h,q_r,h+1) At G_SA deployment path. The present invention not only takes into account the bandwidth requirements of the chain, but also takes into account the transmission delay into the network cost. Defining the network cost generated by service chain deployment as:

in order to minimize the network cost generated by deploying the security service chain, the invention takes the minimization of the network cost as the optimization target when the service chain is generated on the premise of meeting the bandwidth requirement of the service chain and successfully deploying the security function. The invention preferentially deploys the service chain with larger communication bandwidth facing to a plurality of service chain requests arriving at the same time, thereby avoiding bandwidth resources becoming service chain deployment bottleneck and simultaneously reducing network cost. Therefore, in the fourth step, in the service chain deployment process, a divide-and-conquer method is adopted to divide the deployment problem of each service chain into smaller sub-service chain deployment problems, so that the algorithm complexity is reduced. PartitioningThe basis is as follows: for service chain Q_rSafety function requirement q in (1)_r,hIf in the underlying topology G_SIn which only a unique security function node v exists_iCan provide q_r,hFunctional requirement, i.e. functional requirement q_r,hV can and can only be deployed on nodes_iThen the function requirement q is set_r,hDeployed at node v_iUpper (i.e. N)_r(q_r,h)＝v_i) And with q_r,hPartitioning service chains Q for boundaries_rForming a sub-service chain. FIG. 5(b) service chain Q₂LB function requirement in (1), G in FIG. 5(a)_SIn only node v₅Can provide LB function, therefore Q₂LB function requirement in (1) can only be deployed in a node v₅And bound Q by LB functional requirements₂Split into two sub-service chains. And deploying the divided sub-service chains in sequence, and connecting the obtained deployment result of the sub-service chains and the routing result in sequence to obtain the deployment result of the service chain.

And for each sub-service chain, sequencing the communication links according to the bandwidth requirement, and sequentially deploying the links according to the sequence. If the link (q)_r,h,q_r,h+1) Of the two ends of (a) of (b) of_r,hAnd q is_r,h+1None deployed, then mark link (q)_r,h,q_r,h+1) The flow is in an undetermined state, and the next flow is deployed; if the link (q)_r,h,q_r,h+1) Has been successfully deployed, link (q) is established to the link_r,h,q_r,h+1) And (6) deploying. Selecting a Link (q)_r,h,q_r,h+1) Another endpoint (at q) not yet deployed_r,hFor example, then q_r,h+1Representing an endpoint that has been successfully deployed), if endpoint q_r,hBoth the former and latter security functions of (a) are deployed, then according to the endpoint q_r,hPrevious safety function requirement q_r,h－1And the latter safety function requirement q_r,h+1At G_sCan provide q_r,hAmong the candidate nodes of the function, the link (q) satisfying the selection_r,h,q_r,h+1) And link (q)_r,h－1,q_r,h) Security function physics requiring bandwidth of two-segment link and minimizing network cost of two-segment linkNode as q_r,hThe deployment node of (2); if q is_r,hThe former or latter security function of (a) is not deployed, and q can be provided_r,hSelecting all candidate physical nodes of the function to satisfy link (q)_r,h,q_r,h+1) Allocating nodes and links with minimum network cost and bandwidth requirement, and judging Q_rThrough function q_r,hAnother link (q) of_r,h－1,q_r,h) Whether it is in a pending state. If the link (q)_r,h－1,q_r,h) In pending state, link (q) is mapped using the same method_r,h－1,q_r,h) And the end point thereof is deployed and continuously judges to pass through the function q_r,h－1Whether the unassigned link is in a pending state. If the link (q)_r,h－1,q_r,h) If not, the next link is deployed according to the sequence obtained by the bandwidth requirement sequencing until the service chain Q_rAll the functional requirements and link requirements in (1) are deployed and completed. If in the process of deployment, G_sThe service chain fails to be deployed if it cannot provide the security functions required by the service chain or cannot meet the bandwidth requirements of the service chain.

The following illustrates the process flow of the present invention.

Inputting: underlying security function network topology G_S＝(V_S,E_S) Service chain requests Q arriving at the same time₁、Q₂、Q₃As shown in fig. 5;

and (3) outputting: a safety node deployment result of the service chain request and a routing result between nodes;

1. comparing service chaining requests Q₁、Q₂、Q₃The maximum link bandwidth requirements (4 Mbps, 8Mbps and 10Mbps respectively) are arranged in descending order according to the maximum link bandwidth requirements and are arranged according to Q₃、Q₂、Q₁The order of deployment of the service chains in turn.

2. For request Q₃(IDS, IPS, FW, NAT, LB) due to the underlying topology G_SWherein there is a unique FW function node (node v)₁) And LB function node (node v)₅) Then Q will be₃FW and LB Functions in (1)The demands are respectively deployed at v₁And v₅Upper (i.e. N)₃(q_3,3)＝v₁，N₃(q_3,5)＝v₅) And dividing service chain Q by using FW and LB function requirements as boundaries₃. Obtain a sub-service chain sequence Q₃ ¹＝(IDS,IPS,FW)，Q₃ ²＝(FW,NAT,LB)。

3. Deploying a chain of sub-services Q₃ ¹Preferentially deploy Q₃ ¹Links with large bandwidth requirements are deployed firstly, namely links (IDS, IPS) and then links (IPS, FW).

3.1 for the link (IDS, IPS) to be deployed, marking the link (IDS, IPS) as a pending state and deploying the next link (IPS, FW) because neither the IDS nor the IPS is deployed;

3.2 for Link (IPS, FW), FW has been successfully deployed at node v₁IPS on service chain Q₃ ¹The last functional requirement (IDS) in G is not yet deployed_STo select a node (referred to as a candidate node, i.e., v) that can provide IPS security functionality₃,v₆) Deploying a service chain Q₃ ¹IPS requirements of (1); selecting and v among candidate nodes₁The bandwidth capacity between the nodes can meet the bandwidth requirement bw (IPS, FW) of a link (IPS, FW), and the node with the minimum network cost between the IPS and the FW deploys the IPS requirement, namely the IPS is deployed at the node v₆I.e. N₃(q_3,2)＝v₆，L₃(q_3,2,q_3,3) Is v is₆→v₁(ii) a Determine a passing service chain Q₃ ¹Whether another flow of the IPS function in question, i.e. link (IDS, IPS), is pending.

3.3 because the link (IDS, IPS) is in pending state, deploy the link (IDS, IPS) according to step 3.2 to get N₃(q_3,1)＝v₂，L₃(q_3,1,q_3,2) Is v is₂→v₇→v₆(ii) a Sub-service chain Q₃ ¹The deployment is successful.

4. Deploying a chain of sub-services Q₃ ²Preferentially deploy Q₃ ²The link with the larger bandwidth requirement is arranged in the middle,namely, the link (FW, NAT) is deployed first, and the link (NAT, LB) is deployed later.

4.1 for Link (FW, NAT), FW has been successfully deployed at node v₁NAT on service chain Q₃ ²Has been successfully deployed at node v₅Then at G_SCandidate node of middle NAT function (v)₁₀，v₁₁) The method selects a security function physical node which meets bandwidth requirements bw (FW, NAT) and bw (NAT, LB) of two links, and the total cost of the two link networks is minimum to deploy NAT, namely N₃(q_3,4)＝v₁₀，L₃(q_3,3,q_3,5) Is v is₁→v₆→v₁₀→v₁₂→v₁₃→v₅(ii) a Sub-service chain Q₃ ²Successful deployment, service chain Q₃The deployment is successful.

5. Deploying service chaining request Q₂Split into sub-service chains Q according to step 2 ═ (NAT, LB, IPS)₂ ¹＝(NAT,LB)，Q₂ ²(LB, IPS) and deploy LB functionality requirements at node v₅To above, i.e. N₂(q_2,2)＝v₅。

6. Deploying a chain of sub-services Q₂ ¹If the LB function is successfully deployed and the NAT function is the first security function requirement, and the last security function requirement does not exist, the candidate node (v) of the NAT function is located₁₀，v₁₁) Is selected from₅The bandwidth capacity between the nodes can meet the bandwidth requirement bw (NAT, LB) of the link (NAT, LB), and the node between the NAT and the LB with the minimum network cost deploys the NAT requirement, namely, the NAT is deployed at the node v₁₁I.e. N₂(q_2,1)＝v₁₁，L₂(q_2,1,q_2,2) Is v is₁₁→v₁₃→v₅(ii) a Sub-service chain Q₂ ¹The deployment is successful.

7. Deploying a chain of sub-services Q₂ ²Since the LB function has been successfully deployed and the IPS function is the last security function requirement, there is no next security function requirement, then at the candidate node (v) of the IPS function₃，v₆) Is selected from₅The bandwidth capacity between the nodes can meet the bandwidth requirement bw (LB, IPS) of the link (LB, IPS), and the node with the minimum network cost between the LB and the IPS deploys the IPS requirement, that is, deploys the IPS at the node v₃I.e. N₂(q_2,3)＝v₃，L₂(q_2,2,q_2,3) Is v is₅→v₄→v₃(ii) a Sub-service chain Q₂ ²The deployment is successful. Service chain Q₂The deployment is successful.

8. Deploying service chaining request Q₁(FW, IDS, NAT), according to step 2, deploy the FW function at node v₁I.e. N₁(q_1,1)＝v₁。Q₁Can not be continuously divided into sub-service chains, and Q is directly deployed₁. Preferential deployment Q₁Links with large bandwidth requirements are deployed firstly, namely link (FW, IDS) and then link (IDS, NAT).

8.1 for Link (FW, IDS), FW has been successfully deployed at node v₁In the service chain Q, IDS₁If the next functional requirement (NAT) in (1) is not yet deployed, then in G_STo select a node (referred to as a candidate node, i.e., v) that provides IDS security functionality₂,v₁₃) Deploying a service chain Q₁IDS requirements in; selecting and v among candidate nodes₁Bandwidth capacity between nodes can meet bandwidth requirement bw (FW, IDS) of link (FW, IDS), and the node with the minimum network cost between IDS and FW deploys IDS requirement, namely deploys IDS at node v₂I.e. N₁(q_1,2)＝v₂，L₁(q_1,1,q_1,2) Is v is₁→v₂(ii) a Determine a passing service chain Q₁Whether another piece of traffic of the IDS function (i.e., link (IDS, NAT)) is pending.

8.2 Link (IDS, NAT) is not pending, then process Q sequentially₁The next link in the set, i.e. link (IDS, NAT). Deploying a Link (IDS, NAT) according to step 8.1, obtaining N₁(q_1,3)＝v₁₁，L₁(q_1,2,q_1,3) Is v is₂→v₃→v₁₁(ii) a Service chain Q₁The deployment is successful.

9. All services arrivingAnd after the chain request is deployed, finishing the algorithm and outputting a deployment result. Service chain Q₁,Q₂,Q₃The deployment results are shown in FIG. 6, i.e., Q₁:N₁(q_1,1)＝v₁，N₁(q_1,2)＝v₂，N₁(q_1,3)＝v₁₁Traffic routing L₁Is v is₁→v₂→v₃→v₁₁；Q₂:N₂(q_2,1)＝v₁₁，N₂(q_2,2)＝v₅，N₂(q_2,3)＝v₃Traffic routing L₂Is v is₁₁→v₁₃→v₅→v₄→v₃；Q₃:N₃(q_3,1)＝v₂，N₃(q_3,2)＝v₆，N₃(q_3,3)＝v₁，N₃(q_3,4)＝v₁₀，N₃(q_3,5)＝v₅Traffic routing L₃Is v is₂→v₇→v₆→v₁→v₆→v₁₀→v₁₂→v₁₃→v₅。

The above description is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, several modifications and variations can be made without departing from the technical principle of the present invention, and these modifications and variations should also be regarded as the protection scope of the present invention.

Claims

1. A safety function deployment method based on a service chain is characterized by comprising the following steps:

first, the underlying network topology is represented by a weighted graph G_S＝(V_S,E_S) In which V is_SIs a physical node set composed of forwarding nodes and safety function nodes, V_S＝T_S∪N_S，T_SRepresenting a set of routing resource forwarding nodes, N_SFor a firewall security function node set, E_SIs a set of links in the physical network,

fourthly, in the service chain deployment process, dividing the deployment problem of each service chain into smaller sub-service chain deployment problems by adopting a divide-and-conquer method;

in the fourth step, the division basis is as follows: for service chain Q_rSafety function requirement q in (1)_r,hIf in the underlying topology G_SIn which only a unique security function node v exists_iCan provide q_r,hFunctional requirement, i.e. functional requirement q_r,hV can and can only be deployed on nodes_iThen the function requirement q is set_r,hDeployed at node v_iTo above, i.e. N_r(q_r,h)＝v_iAnd with q_r,hPartitioning service chains Q for boundaries_rForming a sub-service chain, deploying the divided sub-service chains in sequence, and connecting the obtained deployment result of the sub-service chains and the routing result in sequence to obtain the deployment result of the service chain;

in the fourth step, for each sub-service chain, the communication links are sorted according to the bandwidth requirement, and the links are sequentially deployed according to the order, specifically:

if the link (q)_r,h,q_r,h+1) Of the two ends of (a) of (b) of_r,hAnd q is_r,h+1None deployed, then mark link (q)_r,h,q_r,h+1) The flow is in an undetermined state, and the next flow is deployed; if the link (q)_r,h,q_r,h+1) Has been successfully deployed, link (q) is established to the link_r,h,q_r,h+1) Deployment is performed, link (q) is selected_r,h,q_r,h+1) If the other endpoint q is not yet deployed_r,hBoth the former and latter security functions of (a) are deployed, then according to the endpoint q_r,hPrevious safety function requirement q_r,h－1And the latter safety function requirement q_r,h+1At G_sCan provide q_r,hFunction(s)Of the candidate nodes of (1), a satisfied link (q) is selected_r,h,q_r,h+1) And link (q)_r,h－1,q_r,h) Taking a safety function physical node with two-section link bandwidth requirement and minimum two-section link network cost as q_r,hThe deployment node of (2); if q is_r,hThe former or latter security function of (a) is not deployed, and q can be provided_r,hSelecting all candidate physical nodes of the function to satisfy link (q)_r,h,q_r,h+1) Allocating nodes and links with minimum network cost and bandwidth requirement, and judging Q_rThrough function q_r,hAnother link (q) of_r,h－1,q_r,h) Whether or not it is in a pending state, if the link is link (q)_r,h－1,q_r,h) In pending state, link (q) is mapped using the same method_r,h－1,q_r,h) And the end point thereof is deployed and continuously judges to pass through the function q_r,h－1Whether the unallocated link is in a pending state; if the link (q)_r,h－1,q_r,h) If not, the next link is deployed according to the sequence obtained by the bandwidth requirement sequencing until the service chain Q_rAll the function requirements and link requirements in the system are deployed and completed; if in the process of deployment, G_sThe service chain fails to be deployed if it cannot provide the security functions required by the service chain or cannot meet the bandwidth requirements of the service chain.