Infrastructure distributed denial of service protection
A method of providing infrastructure protection for a network that includes IP addresses as low as a single IP address. An end user sends traffic to an IP address of a projected server publicly available as an anycast address, and sends traffic to the protected network. The traffic is routed via one of several scrubbing centers using the public IP address as anycast address, and the scrubbing center provides infrastructure protection by scanning and filtering the incoming traffic for illegitimate data. After filtering, the legitimate traffic is encapsulated, e.g., via including virtual GRE tunnel information that includes a secret IP address known only to the scrubbing center and the protected server that receives the network traffic. The protected server decapsulates the network packet and responds back to the end user via the scrubbing network.
1. A method of providing infrastructure protection for a protected server of a network organization, the method comprising:
receiving, by a processor, an encapsulated outgoing network packet from the protected server, wherein the encapsulated outgoing network packet is an outgoing network packet which has been encapsulated by the protected server with header information comprising an anycast address for a scrubbing center network, wherein the anycast address acts as a spoof destination address of the outgoing network packet directed to a first scrubbing center of the scrubbing center network nearest to the protected server and is provided by the scrubbing center network as a spoof source address of incoming network packets directed to the protected server, wherein the incoming network packets are from a second scrubbing center of the scrubbing center network nearest to an end user system, wherein the scrubbing center network corresponds to a plurality of scrubbing centers that includes the first scrubbing center and the second scrubbing center, and wherein the protected server is one of a plurality of protected servers in the network organization;
decapsulating, by the processor, the outgoing network packet to generate a decapsulated outgoing network packet by removing the encapsulation added by the protected server that includes the header information; and
transmitting the decapsulated outgoing network packet to the end user system.
2. The method of claim 1 , wherein the anycast address is an internet protocol (IP) address.
3. The method of claim 1 , wherein the decapsulating is performed by the processor at the first scrubbing center nearest to the protected server.
4. The method of claim 1 , wherein the encapsulated outgoing network packet is received at the scrubbing center network and routed to the end user system.
5. The method of claim 1 , wherein the header information comprises generic routing encapsulation tunnel information.
6. The method of claim 5 , wherein the generic routing encapsulation tunnel information comprises use of a single, virtual generic routing encapsulation tunnel.
7. The method of claim 6 , wherein the single, virtual generic routing encapsulation tunnel can serve the plurality of protected servers in the network organization.
8. The method of claim 1 , wherein the second scrubbing center nearest to the end user system comprises one selected from the group consisting of geographically closest, lowest cost, healthiest, with the least congested route, and another distance measure.
9. A non-transitory computer readable storage medium having instructions encoded thereon that, when executed by a processor, cause the processor to:
receive an encapsulated outgoing network packet from a protected server of a network organization, wherein the encapsulated outgoing network packet is an outgoing network packet which has been encapsulated by the protected server with header information comprising an anycast address for a scrubbing center network, wherein the anycast address acts as a spoof destination address of the outgoing network packet directed to a first scrubbing center of the scrubbing center network nearest to the protected server and is provided by the scrubbing center network as a spoof source address of incoming network packets directed to the protected server, wherein the incoming network packets are from a second scrubbing center of the scrubbing center network nearest to an end user system, wherein the scrubbing center network corresponds to a plurality of scrubbing centers that includes the first scrubbing center and the second scrubbing center, and wherein the protected server is one of a plurality of protected servers in the network organization;
decapsulate the outgoing network packet to generate a decapsulated outgoing network packet by removing the encapsulation added by the protected server that includes the header information; and
transmit the decapsulated outgoing network packet to the end user system.
10. The non-transitory computer readable storage medium of claim 9 , wherein the anycast address is an internet protocol (IP) address.
11. The non-transitory computer readable storage medium of claim 9 , wherein the decapsulating is performed by the processor at the first scrubbing center nearest to the protected server.
12. The non-transitory computer readable storage medium of claim 9 , wherein the encapsulated outgoing network packet is received at the scrubbing center network and routed to the end user system.
13. The non-transitory computer readable storage medium of claim 9 , wherein the header information comprises generic routing encapsulation tunnel information.
14. The non-transitory computer readable storage medium of claim 13 , wherein the generic routing encapsulation tunnel information comprises use of a single, virtual generic routing encapsulation tunnel.
15. The non-transitory computer readable storage medium of claim 14 , wherein the single, virtual generic routing encapsulation tunnel can serve the plurality of protected servers in the network organization.
16. The non-transitory computer readable storage medium of claim 9 , wherein the second scrubbing center nearest to the end user system comprises one selected from the group consisting of geographically closest, lowest cost, healthiest, with the least congested route, and another distance measure.
17. An apparatus, comprising:
a processor to:
establish a single, virtual generic routing encapsulation (GRE) tunnel between a first distributed denial of service (DDoS) protection device and a target network using a dedicated internet protocol (IP) address of the target network, wherein the first DDoS protection device is nearest to a protected server of the target network, wherein the dedicated IP address is kept secret between the first DDoS protection device and the target network;
receive, through the single, virtual GRE tunnel, an encapsulated outgoing network packet from the protected server of the target network, wherein the encapsulated outgoing network packet is an outgoing network packet which has been encapsulated by the protected server with header information comprising an anycast address for a scrubbing center network that corresponds to a plurality of DDoS protection devices including the first DDoS protection device nearest to the protected server and a second DDoS protection device nearest to an end user system, wherein the anycast address acts as a spoof destination address of the outgoing network packet directed to the first DDoS protection device of the scrubbing center network nearest to the protected server and is provided by the scrubbing center network as a spoof source address of incoming network packets directed to the protected server, wherein the incoming network packets are from the second DDoS protection device of the scrubbing center network nearest to the end user system, and wherein the protected server is one of a plurality of protected servers in the target network;
decapsulate the outgoing network packet to generate a decapsulated outgoing network packet by removing the encapsulation added by the protected server that includes the header information; and
transmit the decapsulated outgoing network packet to the end user system.
18. The apparatus of claim 17 , wherein the GRE tunnel is configured to serve the plurality of protected servers in the target network.