Eudemon8000E Anti-DDoS SPU

Transcription

1 Today's network attack varieties and intensities grow exponentially. Distributed Denial of Service (DDoS) attacks in 2010 swallowed 100G bandwidths, experiencing a 1000% increase over The diversified network attacks based on application-layer protocols such as HTTP, HTTPS, SIP, and DNS have nearly go beyond of flow-based attack detection means. To handle these network attacks, carriers must provide immediate and effective solutions to two challenges: How to ensure a reliable network against mass attacks and application-layer attacks? How to minimize maintenance expenditure and improve the return on investment (ROI) of anti-ddos measures? Based on years' technical accumulation in security fields and the deep understanding of carriers' services, Huawei Symantec launches its anti-ddos Service Processing Unit (SPU). The anti- DDoS SPU supplies the multi-core and multi-threading hardware structure. Each board delivers both 10G and 20G processing capabilities, which enables flexible expansion and smooth upgrade through the subcard. Together with the distributed chassis of the Eudemon8000E series, the anti-ddos SPU offers 10G to 160G detecting and cleaning performance. 10G SPU 20G SPU SPU Features Industry's Highest Processing Performance High Performance 160G Anti-DDoS Capability Cutting-edge architecture: The detecting center and cleaning center use innovative network processor+multicore+distributed architecture to break through performance bottlenecks and allow linear expansion. Powerful processing capability: Huawei anti-ddos solution offers a processing capability of up to 160G to protect carriers against network attacks. Large capacity: Huawei anti-ddos solution can present 2000 Zones with refined protection for 10,000 IP addresses and common protection for 1 million IP addresses. High Detection Ratio DPI for Defeating DDoS Deep packet inspection (DPI): To accurately detect and identify DDoS traffic, Huawei anti-ddos solution introduces a "seven-layer purification" framework, which effectively identifies and protects against a comprehensive spectrum of modern security threats including scanning and sniffing, malformed packet attacks, as well as attacks at traffic and application-layer levels. Wide-ranging IPv6 defense: Huawei anti-ddos solution provides all IPv4 defense for IPv6, and supports IPv4 and IPv6 together to enable secure and low-cost transition from IPv4 to IPv6. HUAWEI TECHNOLOGIES CO., LTD.

2 Bypass Dynamic statistical analysis Attack traffic Normal traffic Static filtering Malformed packet filtering Special packet control Source validity authentication Session-based cleaning Feature identification filtering Traffic shaping Discard Whitelist Blacklist LAND Fraggle WinNuke Ping of death Teardrop TCP flag Oversized ICMP packets IP option ICMP redirection ICMP unreachable packet Tracert IP source routing option IP timestamp option IP route record option TCP fragment flood SN flood SN-ACK flood HTTP get flood HTTP post flood HTTPS flood DNS query flood DNS reply flood SIP flood TCP flood UDP flood ICMP flood Connection flood UDP flood UDP fragment flood ICMP flood CC HTTP get flood HTTP post flood Traffic shaping Congestion prevention Rapid Response Second Latency Second-level detection: Flow-based detection is inferior with a long latency because it needs to analyze large amounts of logs. Comparatively, Huawei anti-ddos solution employs the DPI technology to capture attack features in real time, detecting attack traffic within seconds. Second latency: The detecting center and cleaning center synchronize session status with results. The synchronization maintains service continuity while ensuring a rapid response (with 10 seconds) to attacks. Robust Reliability: % Reliable platform: Huawei anti-ddos solution is equipped with redundant power supplies and fans, as well as 1+1 MPUs and 3+1 SFUs. The parts redundancy ensures a core routerlevel reliability. In addition, the industry-leading VRP of this solution has 4 million live-network success cases, further improving platform reliability. System reliability: Huawei anti-ddos solution delivers a mean time between failures (MTBF) of 500 thousand hours and a system reliability of % by leveraging load balanced SPUs and links as well as dual-system hot backup networking. Flexible Expansion Smooth Upgrade and Linear Expansion for Maximized ROI Smooth upgrade: The anti-ddos SPU provides smooth upgrade. The 10G SPU and service subcard are scalable up to the 20G SPU. Linear expansion: The Eudemon8000E comes with a maximum of eight SPUs, with performance smoothly upgradeable from 10G to 160G. With linear performance, users can select service modules if desired at the initial phase of the project. For further capacity expansion, they only need to add required SPUs, effectively maximizing ROI. Minimum investment: The anti-ddos detecting and cleaning SPUs can be inserted on the same chassis.

3 Application Scenarios Security Defense at the MAN Egress Customer challenges Mass attack traffic swarms from the backbone network into the metropolitan area network (MAN), causing link congestion on the MAN. Consequently, carriers have to invest much in bandwidth expansion and user experience may deteriorate. Application-layer attack traffic causes target servers to deny services. As a result, users complain a lot and some may quit subscription, and carriers suffer huge economic loss. Solution strengths Resides at the MAN egress, with 160G cleaning performance to prevent link congestion. Defends against more than 30 types of attacks, including Denial of Service (DoS) attacks. Enables secure transition from IPv4 to IPv6 with powerful IPv6 defense. Backbone network 2. Split and monitor traffic. Monitoring center 3. Identify attack targets and report the detection result. 1. Attack traffic flows from the backbone network to targets, causing target breakdown and MAN congestion. 10G Cleaning center ATIC management center CSR BGP MAN Congestion Congestion E8000E 5. Use BGP to advertise route to the host, diverting attack traffic to the cleaning center. 4. Notify the cleaning center of attack targets. Protected zone Protected zone Protected zone 6. Inject cleaned traffic back to the original link using policy-based routing and MPLS VPN. 7. Send traffic and attack logs. Secure Operation at the MAN Egress Customer challenges Mass attack traffic swarms from the backbone network into the MAN, causing link congestion on the MAN. Consequently, carriers have to invest much in bandwidth expansion and user experience may deteriorate. Application-layer attack traffic causes target servers to deny services. As a result, users complain a lot and some may quit subscription, and carriers suffer huge economic loss. How to present Zones with differentiated defense services and ensure carriers' secure operation? Solution strengths Resides at the MAN egress, with 160G cleaning performance to prevent link congestion. Defends against more than 30 types of attacks, including DoS attacks. Enables secure transition from IPv4 to IPv6 with powerful IPv6 defense. Supports defense policies for up to 2000 virtual groups and offers defense, management, and reporting services.

4 Pre-cleaning After-cleaning Logging Management Mirroring Detecting device Upper-layer network ATIC management center Cleaning device Report Report Administrator Traffic cleaning center Zone C Servers Zone A Report Zone B IDC Security Defense Customer challenges The IDC has heavy egress traffic and processes various services. It is vulnerable to mass attacks and application-layer attacks. Solution strengths Delivers a 160G processing capability and rapid response within seconds. Defends against more than 30 types of attacks, including the attacks specifically aiming at IDCs such as UDP flood, CC attacks, HTTP flood, HTTPS flood, DNS attacks, and low-rate attacks. Botnet Normal network Internet Normal traffic DDoS attack traffic Anti-DDoS cleaning center Service zone 3 Entrusted server Service zone 2 Service zone 1 Entrusted server Entrusted server

5 SPU Specifications Model Maximum detecting performance Maximum cleaning performance Response delay Anti-DDoS Zone-based attack defense SN flood attack defense SN-ACK flood attack defense ACK flood attack defense HTTP flood attack defense HTTPS flood attack defense DNS request flood attack defense DNS reply flood attack defense SIP flood attack defense RST/FIN flood attack defense UDP flood attack defense IP fragment flood attack defense Non-TCP/UDP/ICMP flood attack defense CC attack defense Connection flood attack defense Traffic statistics and limit rate Global packet capture Attack event-based packet capture Abnormal event-based packet capture Static fingerprint Global feature filtering Attack log Exception log 20G 20G <= 10s Anti-DDoS SPU

6 Copyright Huawei Technologies Co., Ltd All rights reserved. General Disclaimer The information in this document may contain predictive statements including, without limitation, statements regarding the future financial and operating results, future product portfolio, new technology, etc. There are a number of factors that could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such information is provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice. HUAWEI TECHNOLOGIES CO., LTD. Huawei Industrial Base Bantian Longgang Shenzhen , P.R. China Tel: Version No.: M C-1.0