Security policy translation in interface to network security functions

1. A method for performing, by a security controller, policy translation in a security management system, the method comprising:

receiving, by the security controller, extracted data from a high-level security policy, that is received from an Interface to Network Security Functions (I2NSF) user via a consumer-facing interface;

searching, by the security controller, a target NSF based on the extracted data and a capability of registered Network Security Function (NSF),

wherein the extracted data is extracted through a first state indicating a start or an end of the high-level security policy, a second state for determining a type of the extracted data, and a third state extracting data;

converting, by the security controller, the extracted data into a capability of the target NSF; and

generating, by the security controller, a low-level security policy for the target NSF based on the capability of the target NSF.

2. The method of claim 1 , wherein the first state, the second state, and the third state are transitioned based on a tag character included in the high-level security policy.

3. The method of claim 1 , wherein the converting into the capability of the target NSF is performed through an NSF database including endpoint information, NSF capability information, and field information.

4. The method of claim 3 , wherein the NSF capability information is acquired from a developer's management system through a registration interface data model and includes an NSF container and an NSF capability container.

5. The method of claim 4 , wherein the NSF capability container includes a capability name and an index indicating a capability field.

6. The method of claim 5 , wherein the NSF container includes an NSF name, an NSF specification, and information related to NSF activation.

7. The method of claim 6 , wherein the field information includes an index related to an NSF-facing interface data model for a low-level security policy.

8. The method of claim 1 , wherein the low-level security policy is generated through a content layer related to the high-level security policy and a structure layer for grouping objects with different tags.

9. A security controller for performing policy translation in a security management system, the security controller configured to:

receive extracted data from a high-level security policy, that is received from an Interface to Network Security Function (I2NSF) user via a consumer-facing interface,

search a target NSF based on the extracted data and a capability of registered Network Security Function (NSF),

wherein the extracted data is extracted through a first state indicating a start or an end of the high-level security policy, a second state for determining a type of the extracted data, and a third state extracting data,

convert the extracted data into a capability of the target NSF, and

generate a low-level security policy for the target NSF based on the capability of the target NSF.

10. The security controller of claim 9 , wherein the first state, the second state, and the third state are transitioned based on a tag character included in the high-level security policy.

11. The security controller of claim 9 , wherein converting into the capability of the target NSF is performed through an NSF database including endpoint information, NSF capability information, and field information.

12. The security controller of claim 11 , wherein the NSF capability information is acquired from a developer's management system through a registration interface data model and includes an NSF container and an NSF capability container.

13. The security controller of claim 12 , wherein the NSF capability container includes a capability name and an index indicating a capability field.

14. The security controller of claim 13 , wherein the NSF container includes an NSF name, an NSF specification, and information related to NSF activation.

15. The security controller of claim 14 , wherein the field information includes an index related to an NSF-facing interface data model for the low-level security policy.

16. The security controller of claim 15 , wherein the low-level security policy is generated through a content layer related to the high-level security policy and a structure layer for grouping objects with different tags.