云原生环境高性能微隔离策略管控方案研究  

Research on High-performance Micro-segmentation Policy Control Solutions for Cloud-native Environments

作　　者：刘青 刘千仞 李长连 蔺旋 王贺龙 Liu Qing;Liu Qianren;Li Changlian;Lin Xuan;Wang Helong(China Information Technology Designing&Consulting Institute Co.,Ltd.,Beijing 100048,China;China United Network Communications Group Co.,Ltd.,Beijing 100033,China)

机构地区：[1]中讯邮电咨询设计院有限公司,北京100048 [2]中国联合网络通信集团有限公司,北京100033

出　　处：《邮电设计技术》2024年第8期62-66,共5页Designing Techniques of Posts and Telecommunications

摘　　要：针对云原生环境日益严峻的安全挑战,深入探讨了微隔离技术在云原生安全领域的应用。首先分析了微隔离技术的背景及其在云原生环境的需求特性,随后确立了无侵入式部署、自动化运维、高性能流量管理等核心目标。通过云原生组件集成eBPF技术,同时引入标签化管理机制,实现了适应云原生场景下复杂多变的网络环境的细粒度安全策略管理体系,在提升隔离效能、资源优化、策略灵活性及多场景适应性方面效果显著。In response to the increasing security challenges of cloud-native environments,it deeply explores the application of micro-segmentation technology in the field of cloud-native security.Firstly,it analyzes the background of micro-segmentation technology and its demand characteristics within the cloud-native environments,subsequently it establishes central objectives such as non-intrusive deployment,automated operational management,and high-efficiency traffic management.Through the integration of eBPF technology with cloud-native components and the concurrent adoption of a label-driven management scheme,the study realizes a granular security policy management framework that is adaptable to the complex and mutable network ecosystems inherent to cloud-native scenarios,which has significant effect in improving isolation efficiency,resource optimization,strategy flexibility,and multi scenario adaptability.

关 键 词：云原生安全 零信任 微隔离 工作负载 K8s 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]