GB/T 25068.7-2025Information technology - Security techniques - Network security - Part 7: Network virtualization security (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents".

Drafting.

This document is Part 7 of GB/T 25068 "Information Technology Security Technology - Network Security". GB/T 25068 has been published as follows.

Part 2.

---Part 1: Overview and Concepts;

---Part 2: Guidelines for Cybersecurity Design and Implementation;

---Part 3: Threats, Design Techniques, and Controls for Network Access Scenarios;

---Part 4: Security Protection for Internet Communication Using Security Gateways;

---Part 5: Security Protection for Cross-Network Communication Using Virtual Private Networks;

---Part 6: Wireless Network Access Security;

---Part 7: Network Virtualization Security.

This document is equivalent to ISO/IEC 27033-7:2023 "Information technology - network security - Part 7.security of network virtualization".

guide".

The following minimal editorial changes have been made to this document.

---To align with existing standards, the standard name has been changed to "Information Technology Security Technology. Network Security Part 7: Virtual Networks".

"Simulated Security"

---Added abbreviations such as "ACL", "AR", "eMTC", and "IT" (see Chapter 4);

---Added a note to the content described in Figure 1 (see 5.3.1);

---Added notes for "Bare Metal Architecture", "Host Architecture", "Southbound Interface", and "Northbound Interface" (see 5.3.2 and 8.3);

---Added notes to the contents described in Table 1 (see 7.7);

---Added a note regarding the applicability of GM/T 0068-2019 (see 9.4).

Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents.

This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC260).

Introduction

The purpose of GB/T 25068 is to provide detailed guidance on security aspects for the management, operation, use, and interconnection of information system networks.

This standard is designed to facilitate the adoption of security-related personnel (e.g., cybersecurity personnel) within organizations to meet their specific needs. GB/T 25068 comprises seven departments.

The structure is divided into several parts, and the main objectives of each part are as follows.

---Part 1: Overview and Concepts. Defines and describes concepts related to cybersecurity and provides management guidance.

---Part 2: Guidelines for Cybersecurity Design and Implementation. Provides organizations with guidance on how to plan, design, and implement high-quality cybersecurity architectures.

Provide guidance.

---Part 3: Threats, Design Techniques, and Controls for Network Access Scenarios. This section lists specific threats, design techniques, and controls relevant to typical network access scenarios.

Body risk, design technology and control.

---Part 4: Security Protection for Inter-network Communication Using Security Gateways. Provides guidance on the implementation, operation, monitoring, and auditing of network security using security gateways.

Guidelines on issues related to full control.

---Part 5: Security Protection for Cross-Network Communication Using Virtual Private Networks. Defines the specific measures for establishing secure connections using Virtual Private Networks.

Body risk, design technology and control elements.

---Part 6: Wireless Network Access Security. Defines the specific risks, design techniques, and controls for secure communication using wireless networks.

Elements, providing guidance for selecting, implementing, and monitoring the technical controls necessary for secure communications using wireless networks, applicable to all There are personnel involved in the detailed planning, design, and implementation of wireless network security.

---Part 7: Network Virtualization Security. Identifying network virtualization security risks and providing solutions for the secure implementation of network virtualization.

Guidelines.

It should be emphasized that GB/T 25068 provides more detailed implementation guidelines for network security controls, while GB/T 22081 addresses the aforementioned network...

The network security control has been described in a basic standardized manner.

Information technology security technology network security Part 7: Network Virtualization Security

1 Scope

This document aims to identify security risks associated with network virtualization and to provide guidance for the secure implementation of network virtualization.

Overall, this document aims to assist in the comprehensive definition and implementation of virtualization security within organizations, and is applicable to those responsible for implementing and maintaining security.

Users and implementers of a fully virtualized environment who exercise corresponding technical control.

2 Normative references

This document has no normative references.

3 Terms and Definitions

The following terms and definitions apply to this document.

Supports the creation of logically isolated network partitions on shared physical network infrastructure to enable multiple heterogeneous virtual networks to operate on a shared foundation.

Technologies that can coexist in facilities.

Note. Network virtualization supports aggregating multiple resources and displaying the aggregated resources as a single resource.

[Source. ISO/IEC TR29181-1:2012, 3.3] 3.2 Supports the creation of logically isolated network partitions on a shared physical network, enabling heterogeneous aggregations of multiple virtual networks on the shared network.

Technologies that can coexist.

Note. This includes aggregating multiple resources within a single provider and displaying them as a single resource.

[Source. ISO/IEC TR22417:2017, 3.8] 3.3 Software-defined networking (SDN) Directly program, orchestrate, control, and manage network resources, and design, deliver, and operate network services in a dynamically scalable manner.

The camp's technology.

[Source. ITU-T Y.3300.2014, 3.2.1] 3.4 Virtual Machine (VM) A virtual data processing system that is controlled by specific users and performs its functions by sharing the resources of a real data processing system.

[Source. ISO/IEC/IEEE 24765.2017, 3.4564] 3.5 container an isolated execution environment is used to run software that uses a virtualized operating system kernel.

[Source. ISO/IEC 22123-1:2023, 3.12.4]