10G Platform

Transparent Security

Delivering network security with transparent protection at the endpoints.

  • Arrows

    What Is Transparent Security?

    Transparent Security is a solution that identifies DDoS attack traffic and mitigates the attack at the customer premises or in the access network. This solution leverages a programmable P4-based data plane to add in-band network telemetry (INT) for device identification and in-band mitigation. P4 is an open-source programming language that lets end users dictate how networking gear operates.

  • Line Boxes

    Why Is Transparent Security Important?

    As increasing numbers of devices connect to the network, there are more vulnerable points of attack for malicious actors. DDoS attacks cost the industry billions of dollars each year in malicious traffic delivery costs, traffic scrubbing and service downtime. The ability to quickly identify impacted devices and packets reduces malicious traffic delivery expenses for operators, service interruptions for consumers and costly mitigation efforts further in the packet lifecycle.

  • Circle

    What Problem Are We Solving?

    Typical DDoS mitigation solutions are deployed only at the interconnection points with other networks. This means that they do not protect the network from internal DDoS attacks, and they can also allow networks to be weaponized. Transparent Security can monitor ingress and egress traffic at every point in the network, from the customer premises to the core of the network. This allows operators to quickly identify the local network from which the traffic originates instead of identifying a service area that could include hundreds of devices—which may or may not be impacted by the attack.

In-band Telemetry Specification

V2.1 Telemetry Report

FAQs

How Do You Program the Programmable Data Plane?

P4 is the primary language used for programming the data plane. (The project is hosted at https://p4.org.) Switches running P4 chips are controlled via standard GRPC calls and support:

  • Protocol independent—P4 programs specify how to process packets.
  • Target Independent—P4 is suitable for describing everything from high-performance data center switches to software switches.
  • Field Reconfigurable—P4 supports dynamic changes to the way packets are processed.

Extended Berkeley Packet Filters (eBPF) and Micro-C are alternative programming languages that perform similar functions to P4. The eBPF and Micro-C languages are targeted at servers and may be better suited for gateway devices.

How Does Transparent Security Work with Micronets?

Micronets, a CableLabs innovation project now being commercialized, creates additional layers of security at the customer premises to help protect devices from becoming infected. To do so, Micronets uses SDN combined with device identity to secure devices on a local network. Transparent Security is focused on identifying southbound devices participating in a DDoS attack and stopping infected packets at the source. The programmable data plane, analytics engine and controller used in Transparent Security can be leveraged by  Micronets to improve the packet-processing performance and help Transparent Security confirm the identity of the attacking device.

How Does Transparent Security Differ from Current DDoS Solutions?

Transparent Security mitigates the attack from the home in less than 1 second. Current solutions can take several minutes to recognize the attack and still cannot monitor egress traffic.

Will Adding P4-Enabled Hardware Increase the Cost of Future Generations of CPEs?

The expected CPE costs should be similar to that of the general-purpose CPUs currently performing network functions. These CPUs would be swapped out for a chiplet.

What Are “Chiplets"?

Chiplets are composed of cores of different types, including MIPS-based cores as well as specialized cores used in the programmable data plane. Chiplets refer to an open standard being developed by the OCP Open Domain-Specific Architecture subgroup under OCP Server Working Group.

Can the Programmable Data Plane Be Used for Other Use Cases?

Yes, the Transparent Security source-based DDoS use case is just one of many that can benefit from the programmable data plane. Once deployed, this architecture will open our networks to new waves of innovation and can improve many operations we do today.

With the programmable data plane, it is possible to change the behavior of the network after the hardware has been deployed. Using an analytics engine and controller, as we do with Transparent Security, can provide closed-loop automation or a range of network management capabilities.

Providing new services frequently requires installing new purpose-built hardware or deploying a virtual machine (VM). With the programmable data plane, we can now deploy some of these services on existing switches with very good performance. The following list contains some examples of services that can be deployed with a programmable data plane:

  • Firewall,
  • Future-generation platform for Micronets,
  • Managed router as a service,
  • Layer 4 load balancer, and
  • SD-WAN.
Can Transparent Security Integrate with an Existing Network Monitoring Solution?

Yes, you can implement NetFlow- and IPFIX-compatible protocols in P4 to coexist with established network monitoring solutions.

Do I Have to Change My Networking Device Vendor to Use P4?

Many of the top networking vendors offer switches that support P4. These switches comply with the P4 language standard and can be reprogrammed in the field.

Does Transparent Security Apply to Business or Residential Customers?

Transparent Security can be applied to all customers. With the increased IoT adoption in both the home and work Transparent Security provides the ideal solution for both types of premises.

Is the Solution Specific to HFC Networks?

No. This architecture and solution will work for any access network, including fiber and mobile.

Privacy Issues in the Use of Transparent Security Operations

Transparent Security uses programmable data plane capabilities in network equipment to enable real-time packet processing, high-resolution packet inspection and in-band network telemetry. Although this new technology allows network operators to identify DDoS traffic patterns, the data required to conduct this analysis includes customers’ personal data because of the granularity required to identify and stop attacks at the source device. This analysis examines the header of each packet, which includes source and destination IP addresses and device MAC addresses, among other data fields. As an organization considers deploying Transparent Security, it should also consider implementing necessarily robust and holistic privacy-protection practices within all elements of Transparent Security and its data flows (e.g., data minimization, processing and data retention limitations, access limitations, encryption), given the potential privacy risks to consumers. For more information, please see our Transparent Security Privacy Warning.

Learn More