Architecture of Security Components

Figure 8.2 shows the architecture of security components in a cloud DCN. ^[1]

FIGURE 8.1 Overall security solution for cloud DCNs.

FIGURE 8.2 Architecture of security components.

The intelligent security analysis service is usually provided by an independent security analyzer, which uses big data analytics and machine learning technologies to detect advanced threats from the telemetry data of existing networks. It can detect new unknown threats that the legacy signature-based detection cannot, while also accelerating the response to, and investigation of, security events. Put simply, this security service shifts from single-point passive defense to network-wide proactive defense.

2. Control layer

The control layer refers to the SDN controllers. One technique used to build the control layer involves using a set of controllers to provide all network functions, including security services. An alternative is to use two SDN controllers (network controller and security manager) to orchestrate and provision the basic network services and security services, respectively.

Network controller: The network controller provides network orchestration capabilities, dynamically provisions network services on demand, and diverts specified traffic to target security devices as required. Connecting to the cloud platform in the northbound direction and to switches in the southbound direction, it provides a web UI for network modeling and orchestration, as well as for automatic delivery of network configurations. In addition, the network controller also provides microsegmentation, SFC orchestration, and configuration delivery. SFC enables users to divert traffic to security devices to provision security services.

• Security manager: The security manager orchestrates security services (such as IPsec, security policies, anti-DDoS, security content detection, and address translation) and dynamically provisions security services on demand. It provides security service orchestration and unified security policy management, models and orchestrates security services, and automatically delivers security service configurations. In addition, the security manager collaborates with the network controller, security devices, and security analysis system to provide network-wide proactive security defense, which comprehensively detects, analyzes, and responds to threats.

Two sets of SDN controllers are deployed but decoupled from one another, facilitating future service upgrades and scale-out. In addition, these controllers can connect to external systems to provide differentiated functions and facilitate functional scale-out and secondary development. For example, the security manager can connect to a dedicated big data analysis platform to receive results and provide guidelines on security service deployment and adjustment, delivering higher-level security protection capabilities as a result.

This solution is recommended by Huawei, and a large number of enterprises are now decoupling network controllers from security managers when building their cloud DCNs. Further chapters in this document will elaborate on the controller decoupling solution in more detail.

3. Forwarding layer

The forwarding layer consists of physical and virtual network devices, including DC switches and security devices. They work together to implement security protection at the DC or tenant border, or within a tenant.

DC switches carry network traffic and provide security capabilities such as ACL, security group, and microsegmentation. They can also redirect specified traffic to security devices, such as firewalls, IDS, IPS, and WAFs, which then perform security detection and defense using their security capabilities.

A cloud DCN supports a large number of users, and the DC’s switches and firewalls support virtual systems, such as VRF or vSys/

VD. While a set of virtual systems can be allocated to a user, virtual systems of different users do not affect each other. Inter-user traffic is blocked by default, which narrows down security zones. In addition, differentiated security policies can be formulated based on the service characteristics and requirements of different users. These security policies can then be further refined and managed, improving their overall effectiveness.

• [1] Application layer At the application layer, cloud security services are provisionedon demand by the cloud OS, which orchestrates computing, storage,and security resources in a unified manner. Administrators dynamically provision security services using the cloud OS. In the southbound direction, the cloud OS interconnects with the controller todeliver security service requirements. The controller then convertsthe security service requirements into forwarder configurations anddelivers them to network devices.