Extreme Physical Security

Transcription

1 Extreme Networks White Paper Extreme Physical Security Abstract Extreme Networks takes a holistic view of the Physical Security market, leveraging Ethernet technology and features with go-to-market sellers to offer a solution that is both future proof and cost effective. Make Your Network Mobile

2 The Growing Need for Physical Security As technology progresses there are occasions when circumstances align that allow for a fundamental change in an industry. The most notable example of this occurrence was the adoption of Ethernet as the default networking technology. The explosion of Ethernet networks supplanted other competing technologies and allowed for Internet technologies to disrupt numerous industries. Similar to networking technologies, physical security is on the cusp of a transition from analog to digital. As this conversion happens, physical security capabilities and applications are becoming significantly more sophisticated. An effective strategy with an implementation plan is evolving into a business driver rather than a cost center. Some of the new technologies aligned with this shift include powerful access control and video analytics, distributed public address systems incorporating video displays, and building automation for increased security with lower costs. The diversity and broad reach of physical security impacts multiple vertical industries including transportation, education, retail, hospitality, energy and heavy industry. The impact of physical security on business is clear when comparing virtual crimes against physical crimes. In 2009 identity theft loses exceeded $50B, a significant number that was nonetheless dwarfed by the $115B in global retail theft during the same time. Further, proving that physical security is not simply customer theft defense, while the average retail theft was $436 in North America, employee theft was $1889, or four times as great. 1 Physical Surveillance and Perimeter Security Intelligent Buildings (HVAC, Fire) Professional Audio/Video Asset Tracking Heavy Industry Physical Security Transportation and Ports of Call Energy Education Retail Hospitality Identity Theft: Annual Losses in Excess of $50 billion. July 14, Cyber Security Market. (For reference: 2

3 Physical Security in Transition While digital technologies for physical security have existed for some time in the form of proprietary protocols such as LonTalk, BACnet and Modbus, the recent development of new physical security technologies has been driven by convergence onto Ethernet as the technology has evolved to incorporate the required functionality, cost-effectiveness and resiliency to meet the demanding requirements of this market. Converging technologies around a standards-based networking technology has significant advantages for the physical security industry. When incompatible and proprietary standards are used for networking various aspects of products, it is very difficult to provide system-wide communication. Moving to Ethernet can allow HVAC systems to be coordinated with VoIP phones, access control and other security infrastructure components, for example. Leveraging proprietary technologies also stifles innovation and does not allow an industry to take advantage of the economies of scale of a widely adopted technology such as Ethernet. Because Ethernet has become ubiquitous, it is found on most common networking components, allowing for native intercommunication. Avoiding proprietary technologies also allows complexity to be reduced and consolidation of security infrastructure expertise within a single organization. Reducing complexity and collapsing expertise into a single organization can have significant impacts on the operating expenses of organizations deploying Ethernet-based security infrastructures. The benefits of converging on Ethernet for security infrastructures are notable but there are also challenges in that process. The IT and physical security industries are different and it is necessary to address the learning curve for both organizations. Physical security installers are typically equipped with minimal data networking experience, and data networking engineers may be unfamiliar with the requirements for physical security installations and infrastructures. The physical security infrastructure also places new demands on the network infrastructure. Surveillance systems and other life-safety systems bring new levels of availability and performance requirements to a network, and being able to quickly and easily deploy and maintain X X X Ethernet: Common

4 those systems is critical. While the typical data network can utilize Quality of Service (QoS) to provide some measure of performance assurance for data, physical security requires guaranteed performance and availability. To address that need, new technologies are being developed, such as Audio/Video Bridging (802.1BA) that provide methods for synchronized and available transmission of security data when converged with an Ethernet network. While growing pains with this transition exist, there is also recent experience with a similar conversion that demonstrates how this can be done with great success. The telecom industry experienced a shift from analogbased telephone systems to digital Voice-over-IP technology in the last decade. When this process began it was typical to install a separate voice network in parallel to the data network, as there was concern over the ability of the network to provide reliable voice services. Due to the adoption of QoS and technologies to provide very fast fault tolerance, VoIP traffic began to be converged with the data network and today it is second nature to combine the two. Extreme Networks, Ethernet and Physical Security The Extreme Networks approach to deploying IP-based physical security infrastructures is based upon a converged Ethernet layer from the campus core, into the data center, and to the wired or wireless edge. Devices, both local and remote, connect via WLAN, 2G/3G/4G wireless networks and copper or fiber Ethernet connections. System integrators in this market have been looking for a true enterprise-class network solution. Extreme Networks played a significant role in the VoIP transition by developing superior QoS and redundancy technologies, and is well positioned to take a similar role in the transition of physical security technologies. Extreme Networks capabilities include a resilient and modular operating system, ExtremeXOS, along with timing and synchronization, protected packet rings which the company pioneered, and hardware-based OAM and traffic engineering. Using these technologies, what previously were multiple standalone networks may now be converged into a single, scalable Ethernet infrastructure. What Extreme Networks has been able to do is to leverage its experience in providing mission-critical and high-performance Ethernet solutions with a history of providing superior technology into this space. In addition, Extreme Networks solution creates an infrastructure that addresses a major concern regarding the move from analog to digital. Because digital solutions do not function with signal degradation unlike analog technologies that could present a static video stream during signal transmission issues for example digital physical security infrastructures introduce new resiliency and uptime requirements that can go beyond those commonly found in campus networking. Recognizing the requirement of simplicity in deploying, operating and administering these next generation security infrastructures, Extreme Networks provides powerful technologies to accomplish these needs: Network Uptime If the security platform is unable to correctly monitor and record a critical event, more serious issues may arise. And it is during these events that the network is many times under the greatest stress. Uptime is influenced by operating system design, hardware redundancy and the ability of the network to self-heal. Extreme Networks offers a number of key capabilities to help ensure network uptime: ExtremeXOS, a resilient and extensible network operating system for the most demanding of networks. A single OS across the end-to-end product line lends predictability for services and configuration. ExtremeXOS is also fully modular, helping protect critical processes, as well as integrating process monitoring and restart. Self-healing based on Extreme Networks Ethernet Automatic Protection Switching (EAPS) packet ring technology and its G.8032 standards-based variant. This provides sub-50ms failover that permits the network to withstand the failure of hardware or uplinks. Where rings are not possible, Multi-switch Link Aggregation Groups (M-LAG) provides the ability for an edge switch to connect to two uplink switches without having to deploy Spanning Tree Protocol (STP), permitting both links to be used simultaneously. Hardware redundancy including uplink, management module, and power supply failover and in-service swap-outs. Extended temperature range allowing operation in hostile environments. 4

5 Bandwidth Scalability Depending upon the requirement, surveillance may require HD quality, and a deployment with hundreds of cameras can place significant bandwidth demands on the network. Extreme Networks pay-as-you-grow stackable and core solutions provide scalability from 1G through 10G and 40G. In addition, at the edge where density is a requirement, the Summit family of switches 1RU form factor offers industry-leading port density. Power Extreme Networks offers a full line of PoE and PoE Plus capable edge switches. Versatility at the edge is increased, while TCO is decreased. Automation and Intelligence Extreme Networks hardware platforms, in conjunction with ExtremeXOS, offer intelligence, manageability and extensibility that help raise the physical security infrastructure to the next level. This is critical in that new IP-based physical security networks may be operated by teams unfamiliar with the technology. Because of the potential for more complex configurations, automation and intelligence is required to minimize the opportunity for operator error. In addition, automation ensures security in a more open IP environment. Capabilities include: User intelligence leverages Identity Manager to identify the user, her role and security requirements, and then automatically configure the network including security and QoS. Device intelligence leverages Secured Port (SP) to offer the same capability as user intelligence, but for the world of machines. For example, QoS and security (VLAN, ACLs) may be set differently for surveillance cameras over VoIP phones or desktop users. In addition, SP locks down ports from unauthorized device access. This port level configuration can be done automatically based on device identification using MAC or LLDP information. Traffic intelligence optimizes network resources and offers QoS based on user or device requirements including 802.1Q and 802.1p, as well as IP Multicast. Extreme Networks solution transparently supports RTSP. Virtual Machine intelligence (VM) leverages XNV (ExtremeXOS Network Virtualization) to permit deployment of VMs in support of physical security to drive network efficiencies and reliability. XNV automates the movement of VMs and their applications. Operations and Maintenance (OAM), both hardware and software OAM, enable the planner to guarantee SLAs for mission critical infrastructure. Scripting and Extensibility leverages ExtremeXOS open interfaces to permit the network engineering to personalize the physical security installation. As an example, Extreme Networks CLEAR-Flow permits the network to detect in real-time when throughput from a camera has dropped, triggering a PoE port cycle or SNMP trap to the operator. Extreme Networks XML APIs enable reliable and secure external device-to-device management communication. The API interface provides a mechanism to communicate with Extreme Networks switches using XML messages. Its standards-based SOAP/XML architecture makes it easier to integrate the network infrastructure with higher-level application and business software. The configuration and monitoring capabilities provided by the APIs let you create customized security infrastructures that might turn off VoIP phones when a room is empty and turn them on when motion is detected. Automatic provisioning for edge switches reduces the amount of human interaction required to bring an edge switch to the required configuration. Automatic provisioning is designed to reduce operational cost and deployment time involved in large scale network access (or edge) deployments and is available on all Summit switch platforms. Critical Services Support Support for critical traffic and services is enabled via the Universal Port capability detailed above, as well as: Timing and synchronization, Synchronous Ethernet (SyncE) and IEEE 1588v2 provides the infrastructure for mission-critical telemetry and control. Audio Video Bridging (AVB) provides the Ethernet infrastructure for video monitoring SLAs and critical for professional video and audio deployments. 5

6 A Versatile Platform The Extreme Networks infrastructure offers a platform to which a diversity of endpoints may connect in a secure and manageable way. These endpoints can leverage Ethernet s accessibility and reach, while offering lower cost and increased endpoint intelligence in contrast with previous solutions. Cameras, transitioning from analog to network video for local and remote monitoring Detection devices, local or remote, also can leverage the IP infrastructure Access and intrusion systems that are pervasive and cost-optimized HVAC control in support of smart/green buildings Telemetry and process control are able to leverage Ethernet s new mission-critical capabilities Recording and viewing devices for local and remote management of the physical security infrastructure Verticals taking advantage of this architecture include applications as diverse as physical security, intelligent building and transportation, professional audio/video, heavy industry such as refineries, and ports of call. The criticality of these installations spans the gamut from the corner office building to nuclear reactors and chemical refineries. At a high level, the converged Ethernet layer extends to the wired and wireless edge, through the core, and into the data center. User, device and traffic intelligence are applied to the various device types connecting to the edge, while virtual machine intelligence can add manageability to the virtualized data center (Figure 1). Within a physical security deployment, it is this edge connectivity that is likely of greatest interest. Figure 2 depicts a typical high-availability installation within a campus. ExtremeXOS Intelligence Layer Cameras Fire and Chemical Detection VM Access and Intrusion User Intelligence Device Intelligence Ridgeline Virtual Machine Network Intelligence Traffic Intelligence HVAC Telemetry and Process Control WLAN Capability for integrated WLAN Controller Recording and Viewing 2G/3G/4G Devices Edge Campus Core Data Center Converged Ethernet Layer Figure 1: Extreme Networks Converged Ethernet and Intelligence for Physical Security 6

7 HVAC and Fire Servers (Video, Security) Perimeter Security SummitStack PoE and Non-PoE Surveillance Cameras 10 Gbps EAPS 10 Gbps EAPS Hardened Asset Tracking 100 Mbps 1 Gbps Figure 2: Extreme Networks Ethernet-Based Physical Security Deployment Parting Thoughts Extreme Networks is working with industry associations focused on the transition of physical security from analog to digital to help ensure the infrastructure can be put into place to provide the foundation for next generation security services. The hardware and software advantages provided by Extreme Networks will help enable a transition to occur more quickly and simply, while offering a manageable, reliable and available physical security infrastructure. Make Your Network Mobile Corporate and North America Extreme Networks, Inc Monroe Street Santa Clara, CA USA Phone Europe, Middle East, Africa and South America Phone Asia Pacific Phone Japan Phone Extreme Networks, the Extreme Networks logo, ExtremeXOS, Summit and XNV are either registered trademarks or trademarks of Extreme Networks, Inc. in the United States and/or other countries. Other names may be trademarks of their respective owners. Specifications are subject to change without notice. 1779_01 04/11