CLOUD DCN SECURITY SOLUTION

This section describes the technical solutions available for virtualization security, network security, advanced threat detection and defense, border security, and security management.

The following uses Huawei iMaster NCE-Fabric as the network controller and Huawei SecoManager as the security manager.

Virtualization Security

A large number of VMs are deployed in a DC to run various applications. Virtualization security refers to VMs that are grouped to implement security control and isolation.

1. Security group overview

Security groups can control and isolate mutual access between VMs so that tenants can customize security isolation for their leased VMs.

As shown in Figure 8.3, VMs can be added to or removed from a security group. By matching the five-tuple of packets, the system can filter the incoming and outgoing traffic of VM ports, and implement access control and isolation between VMs. Security group rules can also be dynamically migrated with VMs.

Security groups have the following characteristics by service model:

• • A security group is an abstract set of VMs or BMs with the same security attributes, and which also contains a set of security policies applied to these VMs or BMs.
• • Each security group can define both ingress and egress directions, as well as the actions to be taken in each direction.

• - Ingress policy rule: the security policy for incoming traffic destined for a local security group
• - Egress policy rule: the security policy for outgoing traffic of a local security group
• - Action: permit or deny action taken on selected traffic
• • By default, the members of a security group can communicate with each other.
• • If the members of a security group initiate north-south access, they are allowed to access the external network by default.
• • If traffic comes from external networks to security group members, it must match the whitelist policy and the action must be set to permit for mutual access.
• 2. Implementation of the solution

Figure 8.4 shows implementation of security groups on the network overlay.

• • In a VM access scenario, the cloud platform orchestrates security groups and delivers stateful IP tables to the OVS.
• • In a BM access scenario, the cloud platform orchestrates BM security groups, and the SDN controller converts the orchestration into an ACL policy before delivering it to TOR switches.

On a hybrid overlay, OVS is replaced by a virtual switch (for example, Huawei CloudEngine 1800V, or CE1800V for short). Figure 8.5 shows implementation of security groups.

• • In a VM access scenario, the cloud platform orchestrates security groups and the SDN controller provisions security group services to the CE1800V.
• • Security groups are implemented in a BM access scenario in the same way as on network overlay.