Utilizing routing advertisements to automate DDOS scrubbing techniques in a telecommunications network
Aspects of the present disclosure involve systems, methods, computer program products, and the like, for an orchestrator device associated with a scrubbing environment of a telecommunications network that receives one or more announced routing protocol advertisements from a customer device under an attack. In response to receiving the announcement, the orchestrator may configure one or more scrubbing devices of the network to begin providing the scrubbing service to packets matching the received routing announcement. A scrubbing service state for the customer may also be obtained or determined by the orchestrator. With the received route announcement and the customer profile and state information, the orchestrator may provide instructions to configure the scrubbing devices of the network based on the received information to dynamically automate scrubbing techniques without the need for a network administrator to manually configure the scrubbing environment or devices.
1. A method for providing a scrubbing service from a network, the method comprising:
receiving routing information, at an application server, through a first routing protocol announcement session for a device of a telecommunications network in response to a denial of service attack on the device, the routing information comprising at least one Internet Protocol (IP) address associated with the device;
associating the at least one IP address with a customer profile of a scrubbing environment of the telecommunications network, the scrubbing environment providing traffic scrubbing services to the customer of the telecommunications network;
transmitting one or more instructions from the application server to the scrubbing environment to add the at least one IP address to a list of scrubbed IP addresses of at least one scrubbing device of the scrubbing environment in response to the received routing information for the device of the telecommunications network through the first routing protocol announcement session; and
announcing, from the application server, a modified received routing information to a router of the telecommunications network through a second routing protocol announcement session, wherein
the first routing protocol announcement session and the second routing protocol announcement session each comprise a Border Gateway Protocol (BGP) announcement session within the telecommunications network.
2. The method of claim 1 further comprising:
obtaining, at the application server, a customer scrubbing state of the scrubbing environment based at least on the customer profile of the scrubbing environment, the customer scrubbing state comprising an indication of a stored scrubbing state for the at least one IP address associated with the device.
3. The method of claim 2 wherein the customer scrubbing state of the scrubbing environment indicates no existing customer profile stored with the scrubbing environment and the one or more instructions from the application server further create a scrubbing customer profile associated with the at least one IP address of the device in the scrubbing environment.
4. The method of claim 1 further comprising:
accessing a database of customer information to the telecommunications network, the customer information comprising a plurality of IP addresses associated with each customer to the telecommunications network.
5. The method of claim 1 wherein the scrubbing environment comprises a scrubbing controller and a plurality of scrubbing servers, the scrubbing controller providing scrubbing instructions to the plurality of scrubbing servers to provide the traffic scrubbing services to the customer of the telecommunications network.
6. The method of claim 5 wherein the one or more instructions from the application server to the scrubbing environment further comprise a load balancing instruction to load balance the scrubbing service for the at least one IP address across the plurality of scrubbing servers.
7. The method of claim 5 wherein the one or more instructions cause the scrubbing controller to remove the at least one IP address of the device from the list of scrubbed IP addresses of at least one scrubbing device of the scrubbing environment when the at least one IP address associated with the device is no longer announced from the device.
8. An orchestrator device of a scrubbing environment of a telecommunications network, the orchestrator device comprising:
at least one communication port receiving routing information through a first routing protocol announcement in response to a detected denial of service attack on the device, the routing information comprising at least one Internet Protocol (IP) address associated with a device of the telecommunications network;
a processing device; and
a computer-readable medium connected to the processing device configured to store information and instructions that, when executed by the processing device, performs the operations of:
associating the at least one IP address with a customer profile of the scrubbing environment of the telecommunications network, the scrubbing environment providing traffic scrubbing services to the customer of the telecommunications network;
obtaining a customer scrubbing state of the scrubbing environment based at least on the customer profile of the scrubbing environment, the customer scrubbing state comprising an indication of a stored scrubbing state for the at least one IP address associated with the device;
transmitting one or more instructions to the scrubbing environment to add the at least one IP address to a list of scrubbed IP addresses of at least one scrubbing device of the scrubbing environment in response to the received routing information for the device of the telecommunications network through the first routing protocol announcement; and
announcing a modified received routing information to a router of the telecommunications network through a second routing protocol announcement, wherein
the first routing protocol announcement session and the second routing protocol announcement session each comprise a Border Gateway Protocol (BGP) announcement session within the telecommunications network.
9. The orchestrator device of claim 8 wherein the customer scrubbing state of the scrubbing environment indicates no existing customer profile stored with the scrubbing environment and the one or more instructions further create a scrubbing customer profile associated with the at least one IP address of the device in the scrubbing environment.
10. The orchestrator device of claim 8 wherein the scrubbing environment comprises a scrubbing controller and a plurality of scrubbing servers, the scrubbing controller providing scrubbing instructions to the plurality of scrubbing servers to provide the traffic scrubbing services to the customer of the telecommunications network.
11. The orchestrator device of claim 10 wherein the one or more instructions further comprise a load balancing instruction to load balance the scrubbing service for the at least one IP address across the plurality of scrubbing servers.
12. A telecommunications network comprising:
a plurality of scrubbing devices providing traffic scrubbing services to at least one customer of the telecommunications network in response to a denial of service attack on a device of the customer;
a scrubbing controller providing scrubbing instructions to configure the plurality of scrubbing devices to provide the traffic scrubbing services to the at least one customer of the telecommunications network; and
a scrubbing orchestrator in communication with the scrubbing controller, the scrubbing orchestrator:
receiving routing information through a first routing protocol announcement session for the device of the at least one customer in response to the denial of service attack on the device, the routing information comprising at least one Internet Protocol (IP) address associated with the device;
associating the at least one IP address with a customer profile;
transmitting one or more instructions from an application server to the scrubbing controller to add the at least one IP address to a list of scrubbed IP addresses of at least one scrubbing device of the plurality of scrubbing devices in response to the received routing information through the first routing announcement protocol session; and
announcing a modified received routing information to a router of the telecommunications network through a second routing protocol announcement, wherein
the first routing protocol announcement session and the second routing protocol announcement session each comprise a Border Gateway Protocol (BGP) announcement session within the telecommunications network.
13. The telecommunications network of claim 12 wherein the scrubbing orchestrator further:
obtains a customer scrubbing state based at least on the customer profile, the customer scrubbing state comprising an indication of a stored scrubbing state for the at least one IP address associated with the device.
14. The telecommunications network of claim 13 wherein the customer scrubbing state indicates no existing customer profile stored with a scrubbing environment and the one or more instructions further create a scrubbing customer profile associated with the at least one IP address of the device in the scrubbing environment.