Method, apparatus, and computer readable medium for providing security service for data center

Embodiments of the present disclosure relate to a method, apparatus, and computer readable medium for providing a security service for a data center. According to the method, a packet terminating at or originating from the data center is received. At least one label is determined for the packet, each label indicating a security requirement for the packet. Based on the at least one label, a security service chain is selected for the packet, the security service chain including an ordered set of security functions deployed in the data center and to be applied to the packet. The packet is transmitted to the selected security service chain in association with the at least one label, the packet being processed by the ordered set of security functions in the security service chain.

RELATED APPLICATION

This application claims priority to PCT Application No. PCT/CN2018/075487, filed on Feb. 6, 2018, of which is incorporated herein by reference in its entirety.

TECHNICAL FIELD

Embodiments of the present disclosure generally relate to the field of security service provision, and in particular, to a method, apparatus, and computer readable medium for providing a security service for a data center.

BACKGROUND

With the development of new technologies of Network Function Virtualization (NFV), Software Defined Networking (SDN), and Service Function Chain (SFC), network transformation may be inevitable for operators to make network programmable as well as to save cost. Consequently, more and more applications can be deployed rapidly and conveniently based on these new technologies.

The SFC technology enables service providers to deliver end-to-end services dynamically without having to change the underlying network topology. Security is one of challenges to deploy applications successfully using SFC since different types of data for the applications (especially for data centers) need different types of security. However, there is only a little research on security protection for applications using SFC.

Generally, in order to defend against rapid-increasing and evolving attacks (such as malware, Distributed Denial of Service (DDoS), and impersonation), customized security services or features have to be provided dynamically, flexibly and adaptively for application data at reset, data in use, and/or data in transit with different security requirements. However, traditional security appliances (for example firewalls, Intrusion Detection Systems (IDS), Deep Packet Inspection (DPI)) are implemented as hardware-based middleboxes and placed on fixed locations in the network, so it is difficult to meet different security requirements for different data based on the new technologies as mentioned above.

SUMMARY

In general, example embodiments of the present disclosure provide a solution for providing a security service for a data center.

In a first aspect, there is provided a method of providing a security service for a data center. The method includes receiving a packet terminating at or originating from the data center. The method includes determining at least one label for the packet, each label indicating a security requirement for the packet, and selecting, based on the at least one label, a security service chain for the packet, the security service chain including an ordered set of security functions that are deployed in the data center and to be applied to the packet. The method further includes transmitting the packet to the selected security service chain in association with the at least one label, the packet being processed by the ordered set of security functions in the security service chain.

In a second aspect, there is provided an apparatus for providing a security service for a data center. The apparatus includes a processor; and a memory coupled to the processor and storing instructions thereon, the instructions, when executed by the processor, causing the apparatus to perform acts. The acts include receiving a packet terminating at or originating from the data center. The acts include determining at least one label for the packet, each label indicating a security requirement for the packet, and selecting, based on the at least one label, a security service chain for the packet, the security service chain including an ordered set of security functions that are deployed in the data center and to be applied to the packet. The acts further include transmitting the packet to the selected security service chain in association with the at least one label, the packet being processed by the ordered set of security functions in the security service chain.

In a third aspect, there is provided a computer readable medium having instructions stored thereon. The instructions, when executed on at least one processor, cause the at least one processor to carry out the method according to the first aspect.

In a fourth aspect, there is provided a computer program product that is tangibly stored on a computer readable storage medium. The computer program product includes instructions which, when executed on at least one processor, cause the at least one processor to carry out the method according to the first aspect.

Other features of the present disclosure will become easily comprehensible through the following description.

DETAILED DESCRIPTION

As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. The term “includes” and its variants are to be read as open terms that mean “includes, but is not limited to.” The term “based on” is to be read as “based at least in part on.” The term “one embodiment” and “an embodiment” are to be read as “at least one embodiment.” The term “another embodiment” is to be read as “at least one other embodiment.” The terms “first,” “second,” and the like may refer to different or same objects. Other definitions, explicit and implicit, may be included below.

In some examples, values, procedures, or apparatus are referred to as “best,” “lowest,” “highest,” “minimum,” “maximum,” or the like. It will be appreciated that such descriptions are intended to indicate that a selection among many used functional alternatives can be made, and such selections need not be better, smaller, higher, or otherwise preferable to other selections.

FIG.1shows an example system100for providing a security service in which embodiments of the present disclosure can be implemented. The system100includes one or more controllers102which may be distributed across one or more physical hosts and/or one or more virtual hosts. The controller102is configured to control and configure function nodes within a data center101. InFIG.1, the controller102is responsible for managing a security service by creating and exposing a Security Service Chain (SSC), and thus is referred to as SSC controller102.

A security service chain (SSC) is one type of service function chain (SFC), which defines an ordered set of security functions and ordering security policies that must be applied to packets and/or flows selected as a result of classification. A SSC enables security service providers to manage and operate stand-alone security services as well as to provide customized security services which can be integrated into other services such as Intelligent Transport System (ITS), video services and location services. In this way, service providers (for example, ITS service provider, video service provider, location service provider, and the like) can mainly focus on their own basic service logics and get professional security services from security service providers in order to provide secure services to the end users.

The data center where one or more SSCs can be established may be referred to as a Service Security Chain (SSC)-enabled domain or data center101, as illustrated inFIG.1. The SSC-enabled data center101includes a storage system130, one or more function nodes, and a network connecting the storage system and the function nodes. In some examples, one or more data collecting points, which may collect data to be stored to the storage system130, may be deployed within or externally to the SSC-enabled domain/data center101. The SSC-enabled domain/data center101can provide security protection for data stored into or obtained from the storage system130. The storage system130may include one or more physical storage devices to store the data, which may be distributed geographically in the same location or different locations (in the case of cloud based storage).

In the SSC-enabled domain/data center101, there are a plurality of Security Functions (SFs)120-1to120-4and associated Service Function Forwarder (SFFs)110-1to110-4, and one or more classifiers104-1,104-2deployed therein. For clarity of discussion, SFs120-1to120-4may be individually or collectively referred to as SFs120, SFFs110-1to110-4may be individually or collectively referred to as SFFs110, and classifiers104-1,104-2may be individually or collectively referred to as classifiers104.

A SF120refers to a service function that is responsible for specific security protection of received packets. A service function can act at various layers of a protocol stack (for example, at the network layer or other OSI layers). As a logical component, a service function can be realized as a virtual element or be embedded in a physical network element. One or more service functions can be embedded in the same network element. Multiple occurrences of the service function can exist in the same administrative domain. One or more service functions can be involved in the delivery of added-value services. In a SSC-enabled domain, the SF120provides a service functionality of security protection, examples of which include, but are not limited to, firewalls, access control, entity authentication, unified threat management (UTM), intrusion detection system (IDS), intrusion prevention system (IPS), virtual private network (VPN), security gateway, Deep Packet Inspection (DPI), Lawful Intercept (LI), traffic cleaning, data integrity validation, data confidentiality protection, data desensitization, data encryption, data decryption, and the like.

In some embodiments, a SSC may include one or more security functions deployed in the network of the SSC-enabled data center101. The security functions in the SSC may be deployed in a certain order to process data of the packets transported in the network. In addition to the security functions, in some embodiments, the SSC may also include other service functions (such as data mining, data analysis and data sharing) to provide corresponding services for the packets.

A SFF110refers to a service function forwarder is responsible for forwarding traffic to one or more connected service functions according to information carried in the SFC encapsulation, as well as handling traffic coming back from the SF. Additionally, an SFF is responsible for delivering traffic to a classifier when needed and supported, transporting traffic to another SFF (in the same or different type of overlay), and terminating the Service Function Path (SFP). The SFF forwarding policy of the SFF110may be generated and obtained or updated by the SSC controller102.

A classifier104is a virtual function or a physical element that performs classification for any received packet or data. The classification policy may be provided by the SSC controller102. The classifier104may determine which SSC a received packet will be passed through.FIG.1shows two example SSCs140and142. The classifier104-1receives a data packet at the packet ingress and provides it into a SSC140, which involves the SFF110-1, SF120-1, SFF110-2, and SF120-2. The data is processed by the SFs120-1,120-2for security protection. If a data packet is read from the storage system130, the classifier104-2receives this packet and provides it into a SSC142, which involves the SFF110-3, SF120-3, SFF110-4, and SF120-4. Data in the packet is processed by the SFs120-3,120-4for purpose of security protection.

It would be appreciated that the architecture inFIG.1is merely illustrated as an example. In some other examples, there may be more, less, or different logic functions included in the system100. In some examples, some logic functions, such as the classifiers, the SFs, and/or the SFFs may be implemented as the same logic functions or implemented in the same physical elements. Although shown as separated paths, the SCCs140and142may include some overlapped security functions to apply the same security protection for incoming and outgoing packets of the storage system130.

Typically, Data Service Providers (DSPs) of data centers offer data services (such as cloud based data service) to vertical market through collecting diversity data from various data resources (such as healthcare, public safety, real estate, transportation, and utilities). In order to obtain profits from the stored data, the DSP analyses raw data and provides value-added services for their customers, as well as shares analyzed/processed data with partners and customers in vertical market. In this way, the partners and customers can further perform data mining and provide value-added services (for example, personal targeted advertising, market trend analysis). However, data storage, data mining, data analysis and data sharing should meet security requirements and regulatory requirements such as GDPR (General Data Protection Regulation) and Cybersecurity laws.

Currently the industry of data centers has many security solutions to provide security protection for both data at rest (stored data) and data in use (data to be accessed). It's also very important for the DSP to provide customized security protection for data in transit, such as data transportation from collecting points to a datacenter or data transportation within/across datacenters. For example, some data needs only integrity protection during transportation, while some data needs both integrity and confidentiality protection during transportation. Although some security mechanisms such as VPN (Virtual Private Network) have been used to provide security protection for data in transit, all data with different security requirements is protected with the same security level (for example, using the same security algorithm, same encryption key, same integrity key, same security filtering policy, and the like), which cannot meet the security requirements for highly sensitive data. Moreover, there may be man-in-the-middle attacks since there is no logical data isolation so that VPN clients and servers are able to know all data. Sometimes different types of data, including public and secret information, may also need to be stored and isolated logically or physically.

In addition, the DSPs may offer cloud based data services and stores data with diversity data formats which adopt different existing security solutions to provide security protection for both data at rest and data in use. Thus, it's important for the DSPs to create a unified mechanism to enable data interoperability or distributed data combination between data stored in different data formats with different data security labels. Further, some DSPs offer cloud based data services and store data with some data formats (such as some self-defined databases) which has no feasible security protection solutions for data at rest or data in use. It is also desired for those DSPs to create data labeling schemes which enable security protection for data at rest and data in use as well as data in transit.

According to embodiments of the present disclosure, there is proposed a solution for providing a security service for a data center. According to this solution, a unified data labeling scheme is provided to label a packet terminating at or originating from the storage system. Each label determined for the packet indicates a security requirement for the packet. On the basis of the determined label(s), a security service chain (SSC) is selected for the packet. The SSC includes an ordered set of security functions deployed in a network the storage system and to be applied to the packet. The packet is then transported to the SSC and is processed by the set of security functions in the SSC. In this way, it is desirable to provide customized security services or features dynamically, flexibly, and adaptively for packets of the storage system with different security requirements.

Embodiments of the present disclosure can be implemented in a system that provides networking security protection functions, for example, the system100ofFIG.1. More specifically, a data labeling scheme can be implemented in the system100ofFIG.1. In some embodiments, the system100may include a data label agent to implement the data labeling scheme for received packets. As shown inFIG.2, the classifier104may include a data label agent202to determine the label(s) for the packet. If a packet terminating at or originating from the data center101is received, the data label agent202in the classifier104determines one or more labels for the packet, each label indicating a security requirement for the packet. The label(s) can be used by the classifier104to select a SSC to which the packet is to be transmitted. There may be one or more SSCs that have been established in the SSC-enabled domain/data center101. If a selected SSC is not established, the SSC controller102may control the establishment of the SSC.

It would be appreciated that although the data label agent202is illustrated as being included in the classifier104, in some other embodiments, the data label agent202and the classifier104may be implemented as separate functions. The data label agent202and the classifier104may be deployed in the same host or implemented in stand-alone hosts as separate functions. In the latter case, the data label agent202may be deployed in the SSC-enabled domain/data center101in upstream of the classifier104. In this way, the data label agent202may receive the packet and determine the label(s) for the packet. The determined label(s) may then be used by the classifier104to select the SSC for the packet.

The classifier104may receive a packet includes data to be stored into the storage system130, or a packet includes stored data that is read from the storage system130. The classifier104may also receive a packet including an access request for data that is stored in the storage system130. The received packet may include authentication and/or authorization data. The label(s) determined for the packet is used to ensure that the data included in the packet or to be accessed by the packet may be securely handled. Thus, a label determined by the data label agent202in the classifier104may sometimes be referred to as a data label.

According to embodiments of the present disclosure, when selecting the SSC based on the label(s) determined by the data label agent202, the SSC may be selected such that at least one security function in the ordered set can be applied to process the packet to meet the security requirement indicated by the determined label(s). In some embodiments of the present disclosure, there may be a set of predefined labels in the system100, each indicating a specific security requirement. The classifier104may select one or more predefined labels for the received packet. Different subsets of labels may be defined to indicate security requirements of a packet from different aspects. The security requirements indicated by the predefined labels as well as how to meet the security requirements by means of selecting corresponding SSC will be discussed in details below.

FIG.3illustrates an example of a data labeling scheme300according to some embodiments of the present disclosure. As shown inFIG.3, data labels310may be divided into a subset of data security labels320, a subset of data format labels330, a subset of data segment labels340, and other data labels350. The data security labels320may be divided into a subset of security level labels for data in transit322, a subset of security level labels for data at rest324, and a subset of security level labels for data in use326. The data segment labels340may be divided in to a subset of labels of industry type342, a subset of labels of technology344, and a subset of labels of geography346.

Different security level labels for data in transit322indicate different security requirements for transmission (transportation) of a packet, especially for transmission of payload included in the packet. According to the security level labels for data in transit322, it would be possible to identify whether security protections for traffic processing, such as integrity protection, confidentiality protection, virus removal, and other security algorithms, need to be applied to the packet during the transportation. Table 1 provides a list of some security level labels for data in transit and their associated security requirements. It would be appreciated that the labels and security requirements are listed in Table 1 for purpose of example only. A different number of security level labels and different security requirements may be predefined as long as the security requirements need to be satisfied during data transportation.

TABLE 1Examples of the security level label for datain transit and associated security requirementsSecurity level label fordata in transitSecurity requirementSecurity-level-transit-0No integrity or confidentiality protectionSecurity-level-transit-1Integrity protectionSecurity-level-transit-2Confidentiality protectionSecurity-level-transit-3Both integrity and confidentiality protectionSecurity-level-transit-4Both integrity and confidentiality protection,and security algorithms with key length of256 bits or 512 bits

By selecting the SSC based on the security level labels for data in transit322, customized security services can be provided for data transportation from data collecting point to the storage system, data transportation from the network perimeter to the physical storage devices of the storage system130and data transportation across geo-distributed storage system. As compared to the transitional solutions which can only provide security protection for data at rest and data in use, the security level labels for data in transit322may further improve the security of data during transportation.

Different security level labels for data at rest324indicate different security requirements for storage of data in the storage system130. If the packet includes data to be stored into the storage system130or includes data obtained from the storage system130, a security level label324may be determined for this packet. According to the security level labels for data at rest324, it would be possible to identify whether security protections for data processing, such as storage with Data Integrity validation, storage with confidentiality protection (encryption), data privacy protection, Data Desensitization, the storage mode, and other security algorithms, need to be applied to the packet. In this way, customized security service and countermeasure could be applied for data at rest according to the security level label324. For example, by selecting the SSC based on the security level labels324, one or more security functions in the SSC can be selected based on the security level labels324to meet the corresponding security requirements. As another example, the SSC is selected such that the SSC is connected to a storage region or storage device of the storage system130in the data center101that meets the corresponding security requirements indicated by the security level label324.

Table 2 provides a list of some security level labels for data at rest and their associated security requirements. It would be appreciated that the labels and security requirements are listed in Table 2 for purpose of example only. A different number of security level labels and different security requirements may be predefined as long as the security requirements need to be satisfied for data storage.

TABLE 2Examples of the security level label for dataat rest and associated security requirementsSecurity level label fordata at restSecurity requirementSecurity-level- rest-0Stored in the cloud without any data processSecurity-level- rest-1Stored in the cloud with integrity protection(for example, adding one metadata to supportData Integrity validation)Security-level- rest-2Stored in the cloud with confidentialityprotection (for example, data encrypted at rest)and privacy protection (for example, DataDesensitization or de-identification)Security-level- rest-3Stored in the cloud with integrity andconfidentiality protection as well as privacyprotection (for example, Data Desensitization)Security-level- rest-4Stored in the cloud with integrity andconfidentiality protection as well as privacyprotection (for example, Data Desensitization),and security algorithms with key length of 256bits or 512 bits. Moreover, data storage shouldbe isolated logically or physically, andjurisdiction of data storage should be compliedwith geographic regulation.

Different security level labels for data in use326indicate different security requirements for access of data in the storage system130. If the packet includes data to be stored into the storage system130or includes data obtained from the storage system130, a security level label326may be determined for this packet. According to the security level labels for data in use326, it would be possible to identify whether security protections related to data access control need to be applied to the packet when selecting the SSC. Table 3 provides a list of some security level labels for data in use and their associated security requirements. It would be appreciated that the labels and security requirements are listed in Table 3 for purpose of example only. A different number of security level labels and different security requirements may be predefined as long as the security requirements need to be satisfied for data access.

TABLE 3Examples of the security level label for datain use and associated security requirementsSecurity level label fordata in useSecurity requirementSecurity-level- use-0No access limitation, anyone has the right tomodify, update or delete the dataSecurity-level- use-1Data accessed with no modification, orupdates, or deletion. Only data owner has theright to modify the dataSecurity-level- use-2Data accessed only by authenticated andauthorized users/applicationsSecurity-level- use-3Data accessed only by authenticated andauthorized users/applications with nomodification, or updates, or deletion. Onlydata owner has the right to modify the data.Security-level- use-4Data accessed only by authenticated andauthorized users/applications with nomodification, or updates, or deletion. Onlydata owner has the right to modify.Moreover, users and applications have to beauthenticated with strong authenticationmethods (for example, two-factorauthentication, multi- factor authentication)

Also referring toFIG.3, the data segment labels340may be divided in to a subset of labels of industry type342, a subset of labels of technology344, and a subset of labels of geography346. If the packet includes data to be stored into the storage system130or includes data obtained from the storage system130, a data segment label340may be determined for this packet. Among the data segment labels340, different labels of industry type342may indicate different security requirements associated with different industry types of data. Different labels of technology344may indicate different security requirements associated with different technology being used by the data center101(more specifically, the storage system130) for storing the data in the packet. Different labels of geography346may indicate different security requirements associated with different geographic locations where data in the packet were generated and/or stored. In some embodiments, a label342,344, or346may explicitly indicate the industry type, technology, or geographic location of the data in the packet, and the industry type, technology, or geographic location may in turn implicitly correspond to different security requirements. Table 4 provides a list of labels of industry type, for technology, and for geography. It would be appreciated that the labels and security requirements are listed in Table 4 for purpose of example only. A different number of labels may be predefined for different industries, different technologies, and different geographic locations.

TABLE 4Examples of data segment labels and corresponding data classificationsData segment LabelsData classificationsLabels ofSegment-industry-1Healthcare/Pharma, for example, dataindustry typesecurity level labels“security-level-transit-4”,“security-level-rest-4” and“security-level-use-4” can be set for thistype of data by defaultSegment-industry-2Transportation/DistributionSegment-industry-3Smart citiesSegment-industry-4Home monitoringSegment-industry-5FinanceSegment-industry-6Energy/UtilitiesLabels ofSegment-technology-1Data stored in dedicated physicaltechnologystorage devicesSegment-technology-2Data stored in the cloudLabels ofSegment-geography-1Datacenter in GermanygeographySgement-geography-2Datacenter in ChinaSgement-geography-3Datacenter in place C

In some embodiments, different types of data segment labels340may be determined for one packet. For example, a packet may be labeled with one or more of the labels342,344, and346, depending on the industry, storage technology, and geographic location of data included in the packet. For example, for healthcare data stored in AWS for Germany citizen, segment-industry-1, segment-geography-1 and segment-technology-2 will be labelled on the data. However, only one label with the same type can be set on the same data at the same time. For example, it's not necessary to set both segment-industry-1 and segment-industry-2 labels on the same data.

Different labels342,344,346may indicate different security requirements because different policies or constrain can be adopted by the data sources from different industries, geographies, technologies, and/or other segments although they have same security level label. Thus, it would be helpful for the subsequent security protection if there is a label indicates the security requirement associated with a certain industry, technology or geographic location. In some embodiments, transportation, storage and/or access of data from different industries may comply with different industrial regulations. By way of examples, data from the industry of Healthcare/Pharma may comply with Health Insurance Portability and Accountability Act (HIPAA); data from the industry of finance may comply with Payment Card Industry Data Security Standard (PCI-DSS); data from Germany may comply with General Data Protection Regulation (GDRR); data from China may comply with Chinese Cybersecurity Law; and data stored in the cloud may comply with ISO 27017.

In some embodiments, by labeling the packet with the data segment labels340, the mandates and directions defined in the associated regulations should be applied on the data for data at rest, in use and in transit. For example, some security functions such as Firewall and DPI (Deep Packet Inspection) scan a packet according to data segment labels340, and then decide what operation (for example, forwarding, dropping, and/or the like) should be performed next. According to regulation compliances in some geographic regions or countries, financial data is scanned only by a dedicated DPI or Firewall.

In some embodiments, in addition to being used for selecting the SSC for a packet, the data segment labels340can also be used to determine whether data from different industries, different geographic locations, and stored (or to be stored) using different storage technologies can be separated logically or physically when they are stored and/or transmitted. The restriction of data storage and/or transmission can be controlled by the SSC controller102.

In an embodiment, packets with different data segment labels340(indicating different geographic locations of the data, different storage technologies used for data storage, and/or industry types of the data) may be separated logically or physically by transmitting through different network zones within the network of the data center101. In this way, for a certain packet with a data segment label340, the data included in the packet may be prevented from being transmitted through a network zone where a further packet with a different data segment label340is transmitted.

In an embodiment, according to the data segment labels340, some data may be restricted in certain regions according to regulation compliances in some geographic regions or countries. The data segment labels340may help achieve such restriction of data transmission. Specifically, according to the data segment label340determined for the packet received by the system100, data included in the packet may be prevented from being transmitted into a first predetermined geographic region or outside a second predetermine geographic region. For example, data generated in China is limited to be forwarded out of China according to Chinese Cybersecurity Law.

Alternatively, or in addition, packets with different data segment labels340(indicating different geographic locations of the data, different storage technologies used for data storage, and/or industry types of the data) may be separated logically or physically by storing into different storage regions. In this way, for a certain packet with a data segment label340, the data included in the packet may be prevented from being stored into a storage region of the storage system130of the data center101for storing data included a further packet with a different data segment label340. Further, limited storage in specified geographic locations (specific jurisdiction) may be applied based on the data segment labels340. For example, a packet with a certain data segment label340may be prevented from being stored into a storage region in a prohibited geographic location. For example, according to regulation compliances in some geographic regions or countries, data labelled with a certain geographic location may not be stored into a storage region outside the particular geographic region (jurisdiction). As a specific example, financial data generated in China is isolated from other data traffic during transportation, and is stored in isolated and physical storage devices located in China.

In some embodiments, the data segment labels340, which can be easily determined by classifying data included in the packet, can be used to help determine the data security labels320. For example, it's a possible that data owners do not know how to set a security level for their data or fail to set a security level for their data correctly. Data segment labels340could assist them in automatically or manually mapping the segment label340to a security level label (in transit, at rest, and/or in use) because data segment labels340can implicitly indicate basic/minimum security requirements for the data. For example, data of patient medical records belongs to healthcare segment. According to data segment labels340, data security labels “security-level-transit-4”322, “security-level-rest-4”324and “security-level-use-4”326may be assigned to data of patient's medical records in order to comply with the HIPAA regulation compliance and customer security requirements. In this way, data security labels can be determined quickly.

Still referring back toFIG.3, data labels310further includes data format labels330. Different data format labels330indicate a format of the packet. Packets from different types of storage systems (datacenters) may be generated in different formats and thus may probably be labeled using existing data labeling schemes. The data format labels may be defined as the types of the databases from where the data in the packets are obtained. The databases may support existing data label schemes or the data label scheme proposed in this disclosure. In some embodiments of the present disclosure, it is proposed to provide a unified data labeling scheme, and thus by means of the data format labels320, it is possible to perform conversion between the existing data labels and those proposed in this disclosure. Although the data format labels indicate the security requirement for the packets, they can otherwise help improve data interoperability or distributed data combination.

It would be appreciated that although some data labels have been discussed above, there may be other data labels that can be defined and used to label packets by the data label agent202. For example, some data labels may be defined to indicate the data owner, data usage tracking, data distribution tracking, data monitoring, data timestamp, data original source, and the like.

Among the set of predefined data labels310, the data label agent202in the classifier104may determine one or more of the following labels for the packet: a first label322indicating a security requirement for transmission of the packet in the SSC, a second label324indicating a security requirement for storage of data in the storage system, and a third label326indicating a security requirement for access of data in the storage system, and one or more fourth labels (342,344, and/or346) indicating a security requirement associated with an industry type of the data, a storage technology being used by the storage system130for storing the data, and a geographic location of data included in the packet. In some embodiments, the data label agent202in the classifier104may also determine a further label (a data format label330) to indicate a format of the packet associated with a further storage system from which the packet is received. If data in the packet is collected from the data collecting points, such data format label may be omitted.

In some embodiments, when the data label agent202in the classifier104determines one or more data labels310for the received packet and transmit the packet to the SSC selected based on the data labels310, the determined labels may be transmitted in association with the packet. In some embodiments, some of the data labels310may be inserted in a header of the received packet by the classifier104. Typically, the header of the packet is used for transportation and will be discarded when the payload of the packet is stored into the storage system130. Thus, one or more data labels310indicating the security requirements to be satisfied during data transportation may be inserted into the header of the packet and then the packet with the modified header may be transmitted by the classifier104. For example, a security level label for data in transit322, a label of industry type342, a label of technology344, and/or a label of geography346may be inserted into a header of the packet.

In one example, Network Service Header (NSH) with MD Type=0x1 (that is, Fixed Length Context Headers) defined in [IETF draft-ietf-sfc-nsh] may be extended as an example to support the insertion of one or more data labels310.FIG.4illustrates a structure of a traditional NSH400with Fixed Length Context Headers. As shown, the NSH400includes five unassigned bits marked as “U” in NSH Base Header and four Fixed Length Context Headers 1 to 4.

FIG.5Aillustrates an example extension of NSH500, where one of the five unassigned bits is used to indicate whether this NSH is a general NSH defined in [IETF draft-ietf-sfc-nsh] or extended NSH in this invention. For this invention, the third unassigned bit marked as “U” in NSH Base Header is chosen and marked as “DL” as for an example. In addition, one of the fixed length context headers is extended to support customized data service security based on data labelling. In the example ofFIG.5A, Fixed Length Context Header2 is selected as for an example and used to carry metadata related to data labels310. In some examples, NSH related to data labels310may also be referred to Label-NSH.

An example of the labels included in the Fixed Length Context Header2510of the NSH500is illustrated inFIG.5B. As shown, a security level label for data in transit322, a label of industry type342, a label of technology344, and/or a label of geography346are inserted in the Fixed Length Context Header. The number of bits used to indicate the labels may be depending on the total number of labels in different types.

It would be appreciated that although NSH with fixed length context headers is discussed above as an example, NSH with MD Type=0x2 (with Variable Length Context Headers) and other types of packet headers may also be extended to support the data labels320. It would also be appreciated that the selection of the header and the arrangement of the data labels in the header are only illustrated for purpose of example only, and many other selections and arrangement may be defined. In some examples, if one or more of the labels are not determined by the data label agent202in the classifier104, the corresponding bits in the header of the packets may be null.

According to the embodiments of the present disclosure, by extending the NSH to add the data labels into the NSH as metadata, fine-grained Security Service Chain (SSC) classification rules may be created based on the data labels and the extended NSH. In this way, customized security services can be offered for labelled data in transit, for example, when the data is imported from a data collecting point to a storage system, transported between network perimeters of the storage system and data storage devices, transported across Geo-distributed storage systems or various sub-systems. In addition, the traffic may be separated logically or physically based on the label in the NSH by selecting the separated SSCs or SSC terminating at different physical storage devices in the system.

In some embodiments, some of the data labels310determined by the data label agent202in the classifier104may be inserted in a payload part of the received packet. Typically, data of the packet is included in the payload part and this part will be stored into the storage system130. Thus, one or more data labels310, which indicate the security requirements to be satisfied during data storage and/or data access, may be inserted into the payload part of the packet by the data label agent202. Then the packet with the modified payload may be transmitted by the classifier104.

In some embodiments, a security level label for data at rest324, a security level label for data in use326, a label of industry type342, a label of technology344, and/or a label of geography346, and a data format label330may be inserted into the payload part of the packet. The data payload related to the data labels310may be referred to as Label-P & D. The data labels310in the payload of the packet may also be referred to as payload metadata and database metadata (since the payload may be stored into the storage system130). Data labels310added as database metadata can support access control for data in use. Data labels310added as payload metadata can support security policy enforcement according to data labels during transportation and support data labels together with data being stored in the database. In some embodiments, the data labels310may be added as visible or invisible metadata element(s) in the storage system130.

FIG.6illustrates an example of a payload portion600including the data labels310. It would also be appreciated that the arrangement of the data labels in the payload are only illustrated for purpose of example only, and many other arrangements may be defined. In some examples, if one or more of the labels are not determined by the data label agent202in the classifier104, the corresponding bits in the payload of the packets may be null.

According the embodiments of the present disclosure, by extending the payload during data storage, data labels added as payload metadata and database metadata can support security policy enforcement according to data labels during transportation and support data labels together with data being stored in the database. Data labels added as database metadata can support access control for data in use. In addition, based on the database metadata and payload metadata, the data may be isolated logically or physically in storage. The data format labels in the payload may also enable data interoperability or distributed data combination between data stored in different data formats.

In some embodiments, the data label agent202in the classifier104may determine one or more data labels for the received packet based on (1) whether the packet include any labels and (2) whether the included labels belong to the predefined data labels of the present disclosure, such as those shown inFIG.3.

FIG.7Aillustrates an example where the classifier104receives701a packet710includes no label. The packet710includes only normal information element (IE) in the header and data in the payload. The packet710may be collected from a data collecting point. The data label agent202in the classifier104may determine one or more data labels for the packet710and insert the data labels into the packet710to generate a packet712. The packet712includes Label-NSH in the header and Label-P & D in the payload part in addition to the original header and payload of the packet710. In some examples, one of the Label-NSH and Label-P & D may be included in the packet712, depending on the labels determined by the data label agent202in the classifier104for the packet710.

The classifier104then selects a SSC740based on the determined labels and transmits702the packet712into the SSC740. The SSC740includes one or more SFs120to process the data payload in the packet712for purpose of security protection. The SSC740also includes one or more SFFs110associated with the SFs120to forward the data payload of the packet712to the associated SFs120and forward the processed data payload of the packet712to the next SFs120according to the header of the packet712. Generally the SFFs110adds the header for the purpose of transportation among the SFs120, and deletes the header if the packet is transmitted to the SFs120for processing or to the storage system130for storage. Thus, the SFF110transmits704the packet714including the payload part of the packet712only to the storage system130. The payload (including the Label-P & D and data) of the packet714is stored in the storage system130.

FIG.7Billustrates an example where the classifier104receives701a packet720includes one or more labels that are defined according to the present disclosure. The packet720may be received from the storage system130(for example, read from the storage system in response to a data access request) and thus include Label-P & D and data in its payload part. As shown inFIG.7B, the data label agent202in the classifier104may determine one or more labels that indicate security requirement to be satisfied during the transportation within the SSC-enabled domain/data center101. These labels may be inserted into the header of the packet as Label-NSH, as discussed above. In some examples, the data label agent202in the classifier104may directly determine such labels. In other examples, the data label agent202in the classifier104may map the labels included in the Label-P & D part of the packet720to the labels to be included in the Label-NSH. The data label agent202in the classifier104may then generate a packet722with the Label-NSH and other IEs included in the header. The packet722is then transmitted702to the SSC740selected based on the Label-NSH. After processing by the SFs120in the SSC740, the SFF110will discard the Label-NSH of the packet722and forward704a modified packet724out of the SSC-enabled domain/data center101.

FIG.7Cillustrates an example where the classifier104receives701a packet730includes one or more labels. If the packet730includes labels that are predefined according to the present disclosure (for example, including Label-NSH in the header and Label-P & D in the payload), this packet may be received from a further storage system that is provided with similar security protection as the storage system130. In this case, the data label agent202in the classifier104may directly use the same labels in the packet730in a packet732, and the classifier104transmits the packet732to the SSC740selected based on the labels. If the packet730includes no Label-NSH, the data label agent202in the classifier104may determine one or more labels for the Label-NSH or map the labels in the payload to the Label-NSH.

If the packet730includes labels that are not corresponding to those predefined according to the present disclosure (for example, including labels in the payload only and are not corresponding to the data labels defined above), this packet may be received from a further storage system that operates with other data labeling schemes. In this case, the classifier104with the data label agent202may map the data labels existing in the packet730to those predefined in the present disclosure. Although some existing data labels included in the payload may probably indicate security requirements only for data at rest and in use, these security requirements may also help determining the corresponding requirements indicated by the data labels of the present disclosure. In some embodiments, the classifier104with the data label agent202may maintain a mapping table which indicates the mapping relationship between the predefined in the present disclosure and those defined according to the existing data labeling schemes.

The classifier104with the data label agent202may generate a packet732including the determined Label-NSH and Label-P & D and transmit702the packet732to the selected SSC740. After traffic processing and data processing for purpose of security protection, the SFF110of the SSC740forwards704a packet734with the data payload of the packet732into the storage system130. The payload of the packet734is then stored in the storage system130.

To better illustrate some embodiments of the present disclosure,FIGS.8-12illustrate some example scenarios where customized security services can be provided to different packets according to the data labeling scheme of the present disclosure. In examples ofFIGS.8-12, the storage system130includes two cloud storages831and832, which are used to store different types of data.

FIG.8illustrates an example to describe providing customized security service chain for data in transit and at rest while data is being imported into the storage system130. In the scenario shown inFIG.8, when receiving a packet including energy/utilities data to be stored into the storage system130. The classifier104-1receives the packet and the data label agent202in the classifier104-1determines appropriate data bales to the energy/utilities data. According to the determined data labels (and possibly other classification rule), the classifier104-1inserts a security level label for data in transit and a label of industry type for the energy/utilities data. The determined labels may be inserted into the header of the packet by the classifier104-1. The classifier104-1then selects, based on the determined labels, a SSC802deployed in the SSC-enabled domain/data center101for the packet. The SSC820is represented by a security function of Firewall821→ a security function of Data Desensitization824→ a security function of Data Integrity825→ Cloud Storage831.

The classifier104-1transmits the packet including the energy/utilities data into the SSC802. In the SSC802, the energy/utilities data is checked by Firewall821, for example, to guarantee that the source of the energy/utilities data is correct. User's sensitive information (for example, user name, home address) included in Energy/Utilities data is removed by the security function “Data Desensitization824” (for example, to guarantee that user privacy is protected). Integrity protection code is generated and added by security function “Data Integrity825” (for example, to guarantee that data at rest is not modified by illegal user or application, in this way the bill of utilities will be generated correctly). The energy/utilities data is then stored into the Cloud Storage831.

There is an alternative SSC801in the SSC-enabled domain/data center101(a security function of Firewall821→ a security function of DPI822→ a security function of Traffic Cleaning823→ a security function of Data Desensitization824→ a security function of Data Integrity826→ Cloud Storage831). The difference between SSC801and SSC802is whether unwanted data including virus or malware will be removed before storing Energy/Utilities data in the Cloud Storage831. If it is determined based on other classification rule that virus or malware removal is needed, the SSC801may be selected. Thus, the classification policy based on data labels can work well with other classification policies without any impact.

In some cases, if the received packet includes healthcare/pharma data, the classifier may determine corresponding data labels for this packet and then select a SSC803for the packet (including a security function of Data Desensitization824→ a security function of Data Encryption826→ Cloud Storage832). User's medical records and sensitive information (for example, name, home address) are split into two different parts by security function “Data Desensitization824” (for example, to improve user privacy protection). Two different parts of Healthcare/Pharma data are encrypted by security function “Data Encryption826” separately (for example, to guarantee that data at rest is not accessed by illegal user or application). Two different encrypted parts of Healthcare/Pharma data are stored in the Cloud Storage832separately in logical isolation or physical isolation.

InFIG.8, each of the security functions is shown to have an associated SFF (one of SFFs811to816) to perform the packet forwarding into or out of the corresponding security/service function. It would be appreciated that some or all of the SFFs may be implemented within the security functions instead of being implemented as separate logic functions.

FIG.9shows how the utilities sector/companies securely access Energy/Utilities data in the storage system130, and then perform data analysis and mining. The classifier104-1receives a packet corresponding to an access request for data stored in the storage system130, and the data label agent202of the classifier104-1may analyse and determine what data labels are applicable to this request. The data label agent202of the classifier104-1may then insert the determined labels to the header (and possibly payload) of the packet. The classifier104-1selects, based on the determined labels, a SSC901deployed in the SSC-enabled domain/data center101for the packet. The SSC901is represented by a security function of Firewall921→ a security function of Access Control922→ Cloud

The data access request is checked by security function “Firewall921” (for example, to guarantee that the request is valid and does not including virus or malware). The data access request is checked by security function “Access Control922” (for example, to guarantee that the utilities sector/companies have the right to access the requested data), and then is provided to the Cloud Storage831.

After obtaining data from the Cloud Storage831, the data label agent202of the classifier104-2near to the Cloud Storage831analyses and decides what data labels are applicable to the data. The data label agent202in the classifier104-2determines and inserts corresponding labels to the payload of the data packet. The classifier104-2then selects, based on the determined labels, a SSC902deployed in the SSC-enabled domain/data center101for the packet. The SSC902is represented by a security function of Data Integrity923→ a service function of Data analysis & sharing924. The classifier104-2inserts corresponding labels into the NSH header of the packet and forwards the packet into the SSC902(directly to the first security function of Data Integrity923in the SSC902). Data integrity is validated for the packet by the security function “Data Integrity923,” and Data analysis and mining is performed by the service function “Data analysis & sharing924.”

InFIG.9, each of the security functions is shown to have an associated SFF (one of SFFs911to914) to perform the packet forwarding into or out of the corresponding security/service function. It would be appreciated that some or all of the SFFs may be implemented within the security functions instead of being implemented as separate logic functions.

FIG.10shows how a doctor securely accesses patient's medical records stored in the storage system130and then performs integration and analysis of medical records. The classifier104-1receives a packet corresponding to an access request for data stored in the storage system130, and the data label agent202of the classifier104-1may analyse and determine what data labels are applicable to this request. The data label agent202of the classifier104-1may then insert the corresponding labels to the payload of the packet. The classifier104-1then selects, based on the determined labels, a SSC1001deployed in the SSC-enabled domain/data center101for the packet. The SSC1001is represented by a security function of Firewall1021→ a security function of Access Control1022→ Cloud Storage832. The classifier104-1inserts corresponding labels into the NSH header of the packet and forwards the packet into the SSC1002(directly to the first security function of Firewall1021in the SSC1002).

The data access request is checked by the security function “Firewall1021” (for example, to guarantee that the request is valid and does not including virus or malware). The data access request is checked by the security function “Access Control1022” (for example, to guarantee that the doctor has the right to access the requested medical records).

After obtaining data from the Cloud Storage832, the data label agent202of the classifier104-2near to the Cloud Storage831analyses and decides what data labels are applicable to the data. The data label agent202of the classifier104-2inserts the corresponding labels to the payload of the data packet. The classifier104-1then selects, based on the determined labels, a SSC1002deployed in the SSC-enabled domain/data center101for the packet. The SSC1002is represented by a security function of Data Decryption1023→ a service function of Data recovery from desensitization1024. The classifier104-1inserts corresponding labels into the NSH header of the packet and forwards the packet into the SSC1023(directly to the first security function of Data Decryption1023in the SSC1002). Data decryption is performed by the security function “Data Decryption1023.” One or more medical records are integrated by the service function “Data recovery from desensitization1024.”

InFIG.10, each of the security functions is shown to have an associated SFF (one of SFFs1011to1014) to perform the packet forwarding into or out of the corresponding security/service function. It would be appreciated that some or all of the SFFs may be implemented within the security functions instead of being implemented as separate logic functions.

FIG.11andFIG.12show how to securely share Healthcare/Pharma data with third parties so that personal targeted advertising on medicine, medical insurance, and medical instruments can be generated and published. InFIG.11, the classifier104-1receives a packet corresponding to an access request for data stored in the storage system130, and the data label agent202of the classifier104-1may analyse and determine what data labels are applicable to this request. The data label agent202of the classifier104-1may then insert the corresponding labels to the payload of the packet. The classifier104-1then selects, based on the determined labels, a SSC1101deployed in the SSC-enabled domain/data center101for the packet. The SSC1101is represented by a security function of Firewall1121→ a security function of Access Control1122→ Cloud Storage832. The classifier104-1inserts corresponding labels into the NSH header of the packet and forwards the packet into the SSC1101(directly to the first security function of Firewall1121in the SSC1101).

The data access request is checked by the security function “Firewall1121” (for example, to guarantee that the request is valid and does not including virus or malware). The data access request is checked by the security function “Access Control1122” (for example, to guarantee that the third party has the right to access the requested Healthcare/Pharma data). In this way, the security requirement for the packet can be satisfied by the two security functions for the transportation of the access request and access of the data to be accessed by the access request.

After obtaining data from the Cloud Storage832, the data label agent202of the classifier104-2near to the Cloud Storage831analyses and decides what data labels are applicable to the data. The data label agent202of the classifier104-2inserts the determined labels to the payload of the data packet. The classifier104-2then selects, based on the determined labels, a SSC1102deployed in the SSC-enabled domain/data center101for the packet. The SSC1102is represented by a security function of Data Decryption1123→ a service function of Data analysis & sharing1124. The classifier104-2inserts corresponding labels into the NSH header of the packet and forwards the packet into the SSC1102(directly to the first security function of Data Decryption1123in the SSC1102). Data decryption is performed by the security function “Data Decryption1123.” Healthcare/Pharma data is analysed by the service function “Data analysis & sharing1124.” In the example ofFIG.11, the SSCs1101and1102may enable securely share Healthcare/Pharma data with third parties.

InFIG.12, the classifier104-1receives a packet corresponding to an access request for data stored in the storage system130, and the data label agent202of the classifier104-1may analyse and determine what data labels are applicable to this request. The data label agent202of the classifier104-1may then insert the determined labels to the payload of the packet. The classifier104-1then selects a SSC, based on the determined labels,1201deployed in the SSC-enabled domain/data center101for the packet. The SSC1201is represented by a security function of Firewall1221→ a security function of Access Control1222→ Cloud Storage832. The classifier104-1inserts corresponding labels into the NSH header of the packet and forwards the packet into the SSC1201(directly to the first security function of Firewall1221in the SSC1201).

The data access request is checked by the security function “Firewall1221” (for example, to guarantee that the request is valid and does not including virus or malware). The data access request is checked by the security function “Access Control1222” (for example, to guarantee that the third party has the right to do personal healthcare advertising according to the determined labels). In this way, the security requirement for the packet can be satisfied by the two security functions for the transportation of the access request and access of the data to be accessed by the access request.

After obtaining data from the Cloud Storage832, the data label agent202of the classifier104-2near to the Cloud Storage831analyses and decides what data labels are applicable to the data. The data label agent202of the classifier104-2inserts the determined labels to the header (and possibly to the payload) of the data packet. The classifier104-2then selects, based on the determined labels, a SSC1202deployed in the SSC-enabled domain/data center101for the packet. The SSC1202is represented by a security function of Data Decryption1223→ a service function of Data recovery from desensitization1224→ a service function of Personal healthcare advertising1225. The classifier104-2inserts corresponding labels into the NSH header of the packet and forwards the packet into the SSC1202(directly to the first security function of Data Decryption1223in the SSC1202).

Data decryption is performed by the security function “Data Decryption1223.” User personal data is recovered by the service function “Data recovery from desensitization1224.” Personal healthcare advertising is performed by the service function “Personal healthcare advertising1225.” In the example ofFIG.12, the SSCs1201and1202may enable personal healthcare advertising without violating the user's privacy.

InFIGS.11and12, each of the security functions is shown to have an associated SFF (one of SFFs1111to1114or SFFs1211to1214) to perform the packet forwarding into or out of the corresponding security/service function. It would be appreciated that some or all of the SFFs may be implemented within the security functions instead of being implemented as separate logic functions.

FIG.13shows a flowchart of an example method1300of providing a security service for a data center in accordance with some embodiments of the present disclosure. The method1300can be implemented by the data label agent202and the classifier104as shown inFIG.2. For purpose of discussion, the method1300is described with reference toFIGS.1to3.

At block1302, the classifier104receives a packet terminating at or originating from the data center101. At block1304, the data label agent202in the classifier104determines at least one label for the packet, each label indicating a security requirement for the packet. At block1306, the classifier104selects, based on the at least one label, a SSC for the packet, the SSC including an ordered set of security functions deployed in the data center and to be applied to the packet. At block1308, the classifier104transmits the packet to the selected SSC in association with the at least one label, the packet being processed by the ordered set of security functions in the SSC.

In some embodiments, the classifier104may select the security service chain such that at least one security function in the ordered set is applied to process the packet to meet the security requirement indicated by the at least one label.

In some embodiments, the data label agent202in the classifier104may determine a first label for the packet, the first label indicating a security requirement for transmission of the packet in the SSC. The first label may be a security level label for data in transit322in the example ofFIG.3.

In some embodiments, the classifier104may modify the packet by inserting the first label into a header of the packet, and then the classifier104may transmit the modified packet to the SSC.

In some embodiments, the packet includes data to be stored or having been stored in the data center. In some embodiments, the data label agent202in the classifier104may determine at least one of the following for the packet: a second label indicating a security requirement for storage of the data in the data center, and a third label indicating a security requirement for access of the data in the data center. The second label may be a security level label for data in transit324in the example ofFIG.3. The third label may be a security level label for data in transit326in the example ofFIG.3.

In some embodiments, the data label agent202in the classifier104may modify the packet by inserting the determined at least one of the second and third labels into a payload part of the packet, and then the classifier104may transmit the modified packet to the SSC.

In some embodiments, the packet includes data to be stored or having been stored in the data center. In some embodiments, the data label agent202in the classifier104may determine a fourth label for the packet, the fourth label indicating a security requirement associated with at least one of the following: a geographic location where the data were generated, a storage technology being used by the data center, and an industry type of the data. The fourth label may include one or more of a label of industry type332, a label of technology334, and a label of geography336in the example ofFIG.3.

In some embodiments, the data label agent202may modify the packet by inserting the fourth label into a payload part of the packet. The classifier104may modify the packet by inserting the fourth label into a header of the packet. Then the classifier104may transmit the modified further packet to the SSC.

In some embodiments, the classifier104may prevent, based on the fourth label, the data included in the packet from being transmitted through a network zone where a further packet is transmitted.

In some embodiments, the classifier104may prevent, based on the fourth label, the data included in the packet from being transmitted into a first predetermined geographic region or outside a second predetermine geographic region.

In some embodiments, the classifier104may prevent, based on the fourth label, from being stored into a storage region of the data center for storing data of a further packet.

In some embodiments, the storage region may be located in a geographic location that is prohibited from storing the data included in the packet.

In some embodiments, the data label agent202in the classifier104may, in response to receiving the packet from a further data center, determine a further label for the packet, the further label indicating a format of the packet associated with the further data center. The further label may be a data format label330in the example ofFIG.3. In some embodiments, the classifier104may transmit the packet to the SSC in association with the further label.

In some embodiments, the data label agent202in the classifier104may determine whether the packet includes a predefined label from a set of predefined labels. In response to determining that the packet includes the predefined label, the data label agent202in the classifier104may map the predefined label to the at least one label. In response to no predefined label is included in the packet, the data label agent202in the classifier104may select the at least one label from the set of predefined labels.

In some embodiments, the data label agent202in the classifier104may determine whether the packet includes a legacy label, the legacy label being excluded from the set of predefined labels. In response to determining that the packet includes the legacy label, the data label agent202in the classifier104may select the at least one label based on the legacy label.

In some embodiments, the SFC may include at least one of the following security functions: a firewall, access control, entity authentication, unified threat management (UTM), intrusion detection system (IDS), intrusion prevention system (IPS), virtual private network (VPN), security gateway, deep packet inspection (DPI), lawful intercept (LI), traffic cleaning, data integrity validation, data confidentiality protection, data desensitization, data encryption, and data decryption.

It is to be understood that all operations and features related to the classifier104with the data label agent202described above are likewise applicable to the method1300and have similar effects. For the purpose of simplification, the details will be omitted.

FIG.14is a schematic block diagram for implementing an example device1400for implementing embodiments of the present disclosure. The device1400may implement the data label agent202, the classifier104, and/or the SSC controller102ofFIG.1or may be part of the data label agent202, the classifier104, and/or the SSC controller102.

As shown, the device1400includes a central processing unit (CPU)1401which is capable of performing various suitable acts and processes in accordance with computer program instructions stored in a read-only memory (ROM)1402or loaded to a random access memory (RAM)1403from a storage unit1408. In the RAM1403, various programs and data required for operations of the device1400may also be stored. The CPU1401, ROM1402and RAM1403are interconnected via a bus1404. An input/output (I/O) interface1404is also connected to the bust1404.

Various components in the device1400are connected to the I/O interface1405, including an input unit1406, such as a keyboard, mouse, and the like; an output unit1407such as various displays, loudspeakers, and the like; a storage unit1408such as a magnetic disk, an optical disk, and the like; and a communication unit1409such as a network card, a modem, a radio communication transceiver, and the like. The communication unit1409enables the device1400to communicate information/data with other devices via a computer network such as Internet, and/or various telecommunication networks.

Various methods and processing described above, such as the method1300, may be implemented with the processing unit1401. For example, in some embodiments, the method1300may be implemented as a computer software program which is tangibly included in a machine readable medium, such as a storage unit1408. In some embodiments, part or all of the computer programs may be loaded and/or installed to the device1400via the ROM1402and/or communication unit1409. When the computer program is loaded to the RAM1403and executed by the CPU1401, one or more steps of the method1300described above may be performed. Alternatively, in other embodiments, the CPU1401may be configured to perform the method1300in any other appropriate manners (for example, by means of firmware).

The components included in the apparatuses and/or devices of the present disclosure may be implemented in various manners, including software, hardware, firmware, or any combination thereof. In one embodiment, one or more units may be implemented using software and/or firmware, for example, machine-executable instructions stored on the storage medium. In addition to or instead of machine-executable instructions, parts or all of the units in the apparatuses and/or devices may be implemented, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Application-specific Integrated Circuits (ASICs), Application-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), and the like.