ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2018, Vol. 55 ›› Issue (4): 768-781.doi: 10.7544/issn1000-1239.2018.20170942

所属专题: 2018网络功能虚拟化专题

• 网络技术 • 上一篇    下一篇

网络功能虚拟化环境下安全服务链故障的备份恢复机制

黄睿,张红旗,常德显   

  1. (解放军信息工程大学 郑州 450001) (河南省信息安全重点实验室 郑州 450001) (xjhr1009@163.com)
  • 出版日期: 2018-04-01
  • 基金资助: 
    国家“八六三”高技术研究发展计划基金项目(2012AA012704);郑州市科技领军人才项目(131PLJRC644)

A Backup and Recovery Mechanism for Security Service Chain Fault in Network Function Virtualization Environment

Huang Rui, Zhang Hongqi, Chang Dexian   

  1. (PLA Information Engineering University, Zhengzhou 450001) (Henan Key Laboratory of Information Security, Zhengzhou 450001)
  • Online: 2018-04-01

摘要: 针对网络功能虚拟化(network function virtualization, NFV)环境下安全服务链(security service chain, SSC)故障问题,提出一种基于比例资源预留的备份恢复机制.该方法采用前摄性处理思想,预先在物理网络中按比例划分主备用资源并构造节点/链路候选集合;当发生节点故障时,从候选集合中选取重映射目标并为其分配预留的备用资源,利用改进的离散粒子群(discrete particle swarm optimization, DPSO)算法及时地解决节点故障重映射问题,在降低资源占用的同时提高故障修复率;当发生链路故障时,通过改变底层物理路径流量分割比例,将受影响流量迁移到候选集合的可用链路中,设计动态路径分割算法有效解决了链路故障重定向问题,实现底层物理网络资源剩余价值最大化.仿真实验验证了算法在不同物理网络环境下的适应性和不同故障模型下的有效性,此外,还初步探索了主用比例的取值对所提备份恢复机制的影响.

关键词: 网络功能虚拟化, 安全服务链, 故障, 备份恢复, 离散粒子群

Abstract: Considering the fault problem of security service chain (SSC) in a network function virtualization (NFV) environment, this paper proposes a backup and recovery mechanism for SSC based on proportional resource reservation. According to the proactive processing idea, it divides the resource proportionally in a substrate network and constructs a candidate set for each substrate node/link beforehand. When the node fault suddenly occurs, it chooses the fault recovery targets in the candidate set and allocates the reserved backup resources. It solves the node fault remapping problem immediately by using the improved discrete particle swarm optimization (DPSO) algorithm, decreasing the occupancy of resources while increasing the repair rate. When the link fault suddenly occurs, it redirects the affected traffic to the available links in the candidate set by changing the traffic splitting-rate of the substrate path. We design the dynamical path splitting algorithm to solve the link fault redirect problem effectively, maximizing the residual value of the underlying substrate network resources. The simulation experiment verifies the proposed algorithm from two aspects: one is the adaptability under different substrate network environments and the other is the validity under different fault models. In addition, we also make a preliminary explore to the appropriate value of the main proportion for the impact of our proposed backup and recovery mechanism.

Key words: network function virtualization (NFV), security service chain (SSC), fault, backup and recovery, discrete particle swarm optimization (DPSO)

中图分类号: