A Scalable DDOS Scrubbing Architecture for Telecommunication Networks

Abstract

Aspects of the present disclosure include systems, methods, and computer program products for an orchestrator device associated with a scrubbing environment of a telecommunications network that receives one or more announced routing protocol advertisements from a customer device under attack. In response to receiving the announcements, the orchestrator can configure one or more scrubbing devices of the network to begin providing scrubbing services to packets that match the received routing announcements. Scrubbing service status for the customer can also be obtained or determined by the orchestrator. Using the received route announcements and customer profile and status information, the orchestrator can provide instructions to configure the scrubbing devices of the network based on the received information, dynamically automating scrubbing techniques without requiring a network administrator to manually configure the scrubbing environment or scrubbing devices.

Description

[Technical field]

[0001] [CROSS REFERENCE TO RELATED APPLICATIONS] This Patent Cooperation Treaty (PCT) patent application is related to and claims priority to U.S. patent application Ser. No. 16 / 905,399, filed June 18, 2020, and entitled "SCALABLE DDOS SCRUBBING ARCHITECTURE IN A TELECOMMUNICATIONS NETWORK," which claims the benefit of priority under 35 U.S.C. § 119(e) to U.S. patent application Ser. No. 62 / 900,357, filed September 13, 2019, and entitled "SCALABLE DDOS SCRUBBING ARCHITECTURE IN A TELECOMMUNICATIONS NETWORK," both of which are incorporated herein by reference in their entireties.

[0002] Embodiments of the present invention relate generally to systems and methods for implementing telecommunications networks, and more particularly, to systems and methods for providing scrubbing services to traffic in response to a distributed denial of service attack by utilizing a hierarchical architecture of scrubbing devices within a telecommunications network. [Background technology]

[0003] Today, content providers (publishers) use the Internet (specifically the Web) to provide all kinds of content to a vast number of users around the world. For example, television programs and movies are now accessible from a number of websites, and these programs and movies can be served from Internet devices. Printed newspapers have given way to the Web, providing portals through which clients operating any form of computing device with a browser (e.g., PC, smartphone, or tablet) can access numerous forms of content, such as short video clips, articles, images, and audio tracks. Today, it is common to seeIt used to be provided on a disk and mailed to the recipient. Software updates and software patches are delivered to the device through one or more network connections and devices. delivery It has been done.

[0004] In some cases, the Internet To Connected Content Providers (Web data providers, etc.) However, providers' networks or devices may be attacked by malicious actors who are attempting to gain access to, or disrupt the operation of, the network or devices from providing content to other users of the Internet. One such attack is the Denial of Service (DOS) attack, which is an attack that attempts to take control of a provider's equipment, thereby preventing legitimate users from Content provider Content Server or others Typically, these attacks involve attacking a content server, or other type of device that provides content, by blocking the access of that device. To Against False requests for information and other legitimate traffic or requests are blocked by the content server. Execution This includes flooding a network with such frequency and volume that it prevents the content from being served. A distributed denial of service (DDOS) attack is similar in purpose, except that the attack is distributed among many devices, typically associated with a unique Internet Protocol (IP) address. The attack is often carried out without the devices' knowledge, so that requests for content are received from potentially thousands of different devices. It should be appreciated that such attacks can adversely affect a customer's ability to provide content to legitimate requesters of the content or information, effectively preventing content from being served to requesting customers. Similarly, network equipment may temporarily fail under the attack load.

[0005] It is with particular regard to these considerations that the aspects of the present disclosure have been conceived. Summary of the Invention

[0006] One aspect of the present disclosure relates to a method of providing scrubbing services from a network, the method including the operations of receiving, at an application server, routing information through a first routing protocol announcement session for a device of a telecommunications network, the routing information including at least one Internet Protocol (IP) address associated with the device, associating the at least one IP address with a customer profile of a scrubbing environment of the telecommunications network, the scrubbing environment providing traffic scrubbing services to a customer of the telecommunications network, and, in response to the received routing information for the device of the telecommunications network, an application server of at least one scrubbing device of the scrubbing environment. vinegar club Will be and sending, from the application server through the first routing protocol announcement session to the scrubbing environment, one or more instructions for adding the at least one IP address to a list of IP addresses.

[0007] Another aspect of the disclosure relates to an orchestrator device of a telecommunications network scrubbing environment, the orchestrator device may have at least one communication port that receives routing information through a first routing protocol announcement in response to a detected denial of service attack on the device, the routing information including at least one Internet Protocol (IP) address associated with a device of the telecommunications network, a processing device, and a computer-readable medium coupled to the processing device. The computer readable medium can be configured to store information and instructions that, when executed by the processing device, include operations of associating the at least one IP address with a customer profile of the scrubbing environment of the telecommunications network, the scrubbing environment providing traffic scrubbing services to customers of the telecommunications network; obtaining a customer mask scrubbing state of the scrubbing environment based at least on the customer profile of the scrubbing environment, the customer mask scrubbing state including an indication of a stored scrubbing state for the IP address associated with the device; and, in response to the received routing information for the device of the telecommunications network, obtaining a customer mask scrubbing state of the scrubbing environment for the at least one scrubbing device of the scrubbing environment. vinegar club Will be and transmitting, via the first routing protocol announcement, one or more instructions to the scrubbing environment for adding the at least one IP address to a list of IP addresses.

[0008] Another further aspect of the present disclosure relates to a telecommunications network, which may include a plurality of scrubbing devices providing traffic scrubbing services to at least one customer of the telecommunications network in response to a denial of service attack on the device of the customer, a scrubbing controller providing scrubbing instructions to configure the plurality of scrubbing devices to provide the traffic scrubbing services to the at least one customer of the telecommunications network, and a scrubbing orchestrator in communication with the scrubbing controller. The scrubbing orchestrator may receive routing information through a first routing protocol announcement session for the device of the customer in response to the denial of service attack on the device, the routing information including at least one Internet Protocol (IP) address associated with the device, associate the at least one IP address with a customer profile, and configure the at least one scrubbing device of the plurality of scrubbing devices in response to the received routing information. vinegar club Will be and sending one or more instructions from the application server to the scrubbing controller over the first routing announcement protocol session to add the at least one IP address to a list of IP addresses. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram illustrating an example network environment operable to provide scrubbing or other network attack defense services to networks or devices connected to an IP network, according to an aspect of the present disclosure.

[0010] [Diagram 2]FIG. 1 is a schematic diagram illustrating an exemplary network environment for providing scrubbing services to network customers during a network attack, according to one embodiment.

[0011] [Diagram 3] FIG. 1 is a schematic diagram illustrating an exemplary network environment for providing scrubbing services to traffic during a network attack on one or more components or devices associated with the network, according to one embodiment.

[0012] [Figure 4] 1 is a flow chart illustrating a method for utilizing a multi-layer scrubbing architecture of a network to provide scrubbing services in response to potential network attacks on devices or networks associated with the architecture, according to one embodiment.

[0013] [Diagram 5] FIG. 1 is a block diagram illustrating an example of a computing system that can be used to implement embodiments of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Aspects of the present disclosure include systems, methods, and computer program products, etc., for providing scrubbing techniques via a scrubbing architecture of a network to mitigate Denial of Service (DOS) or Distributed DOS (DDOS) attacks (collectively referred to herein as DDOS attacks) on destination devices connected to a telecommunications network. In one particular embodiment of the present disclosure, the network includes one or more large scale scrubber devices configured to scrub communications or packets of a large scale DDOS attack on the destination device or network, and .... betweenand one or more small scale scrubber devices configured to scrub communications or packets. The large scale scrubber devices may be configured to scrub communications or packets sent to a destination device during a DDOS attack. Addressed to High traffic To respond The architecture of the small-scale scrubber device may include a larger bandwidth threshold. flat Time or Successful transmission to the destination device Traffic Flow For In this way, during a DDOS attack, R , the period before or after the DDOS attack. R , vinegar Scrub architecture scrubs all traffic to destination device while improving the efficiency of network scrubbing bandwidth. It is possible.

[0015] In one particular embodiment, The network determines which scrubbers in the scrubbing architecture Packets targeted at the destination device (legitimate packets Whether Or part of a DDOS attack and Packets Either ) to scrub the Responsible To control of , related to scrubbing architecture Can be attachedThe scrubbing environment may include a controller or orchestrator device or system. The controller may receive one or more announced routing protocol advertisements from a network device that is under a DDOS attack. In some examples, the device making the announcement may be a small-scale scrubber of the scrubbing architecture. In response to receiving the advertisement or announcement, the controller or orchestrator may determine a scrubbing device of the architecture and configure the determined scrubbing device of the network to begin providing scrubbing services to packets that match the received routing announcement. Additionally, the orchestrator may access a database of customer information and associate the received route announcement with a particular customer. Additionally, a scrubbing service status for the customer (such as whether a customer profile exists on the scrubbing environment, an active or inactive status of the customer profile on the scrubbing environment, a level and type of scrubbing service provided to the customer by the scrubbing environment, etc.) may be obtained or determined by the orchestrator. Using the received route announcements and customer profile and state information, the orchestrator issues instructions to configure the scrubbing devices in the network based on the received information. Well served , in this case, Large-scale scrubbing devices in response to large-scale DDOS attacks 、 and / or protected destinations of The small-scale scrubbing devices can be provided with scrubbing services in response to a return to normal traffic levels. In this manner, the orchestrator can dynamically shift scrubbing services from small-scale scrubbers to large-scale scrubbers in the architecture (and vice versa) based on information it receives from the scrubbers of potential DDOS attacks.

[0016] FIG. 1 illustrates an exemplary network environment 100 operable to provide scrubbing services or other DDOS attack defense services to networks or devices connected to an IP network 102, according to aspects of the disclosure. In general, the environment 100 includes a telecommunications network 102 (a “core network” being an example) that connects networks and / or customers to provide and receive one or more network services. In particular, one or more border networks (such as border network A 104 and / or border network B 106) may connect to the IP network 102 to provide and receive communications with other users or other networks via the IP network 102. In one particular example, the network 102 may connect the border networks 104, 106 to a public network, such as the Internet 108. A network device, such as a destination device 110, may also connect to the network 102 to receive communications or packets from the network 102. In some examples, such a device 110 may be included in the border networks 104, 106. With particular reference to FIG. 1, the environment 100 includes an IP network 102, which may be provided by a wholesale network service provider.

[0017] To facilitate transmission of communication packets / data between computing devices, users, networks, etc., the network 102 may include numerous networking devices. Such devices or components may include, but are not limited to, gateways, routers, route reflectors, and registers that may enable communication and / or provide services across the IP network 102. In some examples, the network 102 may include edge devices 112-118 that connect to or otherwise provide an interface between the network 102 and other networks 104, 106, or devices 110. The edge devices 112-118 (or gateways) may transmit and / or receive communication packets into and out of the network 102. Transmission of received packets through the network 102 may be performed by one or more other network devices connected between the edge devices 112-118. The components of network 102 may be connected by communication paths or lines such that one or more packets may be transmitted between customers or networks through the components of network 102 .

[0018] In addition to routing communications between the networks 104, 106 and / or the devices 110, the network 102 may include a core network 102. Be or related Attached The network 102 may provide one or more services to the network or devices. Be or related AttachedScrubbing services or other defensive services may be provided against DDOS attacks on a network or device. As described in more detail below, scrubbing services may involve sending communications or packets identified as being part of a DDOS attack to a scrubbing device prior to transmission to a destination device 110 or destination network. Send to In some examples, the scrubbing device can identify packets intended to seize or otherwise harm the destination device 110 or destination network, and remove the offending packets from the stream of traffic to the destination while allowing legitimate requests or traffic to be transmitted to the destination device 110 or destination network. Can be attached To provide scrubbing services to the network 104, 106 or device 110, IP The network may have a scrubbing architecture 120 that includes one or more network scrubbing devices. An example of the scrubbing architecture 120 may include a hierarchy of large scrubbers with relatively large bandwidth thresholds and small scrubbers with relatively small bandwidth thresholds. An orchestrator 122 may also be included in the network 102 for controlling one or more aspects of the scrubbing architecture 120. Attached The operations and methods performed by the orchestrator 122 to manage the scrubbing services provided to the networks 104, 106 and / or devices 110 are described in more detail below.

[0019] Network 102 may be optionally configured to facilitate routing of communications through the network and provide one or more services to customers or network 102. For example, network 102 may include a series of interconnected networking devices, such as routers and switches, that receive communications, analyze the communications to determine a destination, and route the communications to connected networking devices to move the communications closer to a destination or egress point (such as gateway 118). To determine which route through the network to use to route a received communication or packet, components of the network may receive route information through one or more route announcing sessions between devices. These route announcing sessions provide routing information between components of the network and between different networks so that components of the Internet and other networks can determine how to route received communication packets.

[0020] One particular example of an announcement of routing information occurs within a Border Gateway Protocol (BGP) announcement. In general, BGP information (or BGP sessions, BGP feeds, or BGP data) is the information about Internet Protocol (IP) prefixes that specify network connectivity between Autonomous Systems (ASs) or separate networks. tableThe BGP information about a network route may include, among other information, a route (including next hop information), a network policy, and / or a rule set for transmission along the route. The BGP feed may also include Interior Gateway Protocol (IGP) information about network routes within an Autonomous System (AS) or network, and / or other network information related to the transmission of content from the network. However, as described below, the BGP information primarily describes routes used by the network 102 to connect to external networks or customers (e.g., border networks 104, 106), while the IGP information describes routes in the network to connect one edge device (e.g., gateway 112) to other edge devices (e.g., gateway 118) through the telecommunications network 102.

[0021] One or more of the components of the network 102 may have a BGP session or others Routing protocol announcement routes or a Through the adoption route, The routes serviced by that component For example, the gateway 118 may provide BGP announcements to other components in the network 102 indicating which networks or devices (such as device 110) are accessible through that gateway. Thus, the gateway 118 of BGP announcements are routes and contact Receives packets from connected device 110. Sending The next hop information may include next hop information that specifies the path along which a particular device in the network 102 can receive or send a packet. Specify , and through that device to the destination device Ma or address Used by Possible Become For example, the border networks 104 and 106 AttachedSpecific Internet Protocol (IP) addresses may be announced from the gateway 112 to other components of the network 102. Although discussed herein as BGP announcements or advertisements, it should be understood that the routing protocol advertisements may be either or both of BGP routes between networks and IGP routes within the IP network 102.

[0022] As previously mentioned, the scrubbing architecture 120 of the network 102 may include multiple tiered scrubbing devices to provide scrubbing services to border networks 104, 106 or devices 110 connected to the network 102. Figure 2 is a block diagram 200 illustrating the scrubbing architecture 120 and orchestrator 122 of the network 102 of Figure 1. Although shown in Figure 1 as being included in the network 102, the orchestrator 122 and / or the scrubbing architecture 120 (or portions of the scrubbing architecture 120) may be separate from the network 102.

[0023] The illustrated scrubbing architecture 120 includes two tiers of scrubbing devices: a first tier 202 of large scrubbers 206-210 and a second tier 204 of small scrubbers 212-222. In general, the large scrubbers 206-210 and the small scrubbers 212-222 are capable of providing the same scrubbing services to traffic received at the scrubbers. Thus, the designations "large" and "small" refer to other aspects of the scrubbing devices. May For example, while any scrubber may provide scrubbing services to the received traffic, the large scrubbers 206 to 210 may provide more efficient scrubbing services than the small scrubbers 212 to 222. Incoming call Traffic ForThey may be configured to have larger bandwidth, more memory, more computing or processing power, etc. In other examples, the large scale scrubbers 206 to 210 may be more costly and in some examples may consume a larger footprint within the networking sites of the network 102 as compared to the small scale scrubbers 212 to 222 due to their larger bandwidth capacity. Generally, references herein to the large scale scrubbers 206 to 210 refer to the large scale scrubbers as compared to the small scale scrubbers 212 to 222. Incoming call 1 shows a scrubber device with bandwidth.

[0024] Although illustrated as two tiers of scrubbing devices, scrubbing architecture 120 may include any number of tiers of scrubbing devices. Each tier of scrubbing architecture 120 may include scrubbing devices that differ in some respects from scrubbers in other tiers in architecture 120. For example, a first tier may include a scrubber with a bandwidth of 600 gigabytes per second (Gbps), a second tier may include a scrubber with a bandwidth of 250 Gbps, a third tier may include a scrubber with a bandwidth of 100 Gbps, some tiers of scrubbing architecture 120 may include scrubbers with larger memory space for storing scrubbing profiles (discussed in more detail below) compared to other scrubbers in architecture 120, scrubbers with higher processing power than scrubbing devices in other tiers, etc. In a further example, one or more tiers of architecture 120 can have different types of scrubbers, such that one tier can include scrubbers with large bandwidths and scrubbers with smaller bandwidths. The number of tiers of architecture 120 and the types of scrubbing devices included in each tier can vary from network to network and can be configured by a network administrator.

[0025] The operation of the scrubbing devices (large scale scrubbers 206 to 210, small scale scrubbers 212 to 222, or any other scrubbing devices having a particular function) will be described with respect to FIG. 3. In particular, FIG. 3 illustrates a scrubbing device associated with network 102. Attached An exemplary network environment 300 is provided for providing scrubbing services to traffic during a DDOS attack on one or more components or devices. In general, the components of the network environment 300 may be incorporated into or included in the IP network 102 of FIG. 1. For example, the network 102 may include a so-called "dirty" router 302, a scrubbing architecture 120, a so-called "clean" router 304, and an orchestrator 122 as part of the scrubbing or anti-attack services provided by the network 102. Although FIG. 3 is illustrated, it should be understood that the telecommunications network 102 may include more or fewer components than are illustrated. Other components, such as customer devices 110 and / or the Internet 108, may form part of the network 102 or may be included in other communications networks. Regardless of the configuration, the network environment 300 of FIG. 3 may be used to provide scrubbing services to traffic associated with the network 102 during a DDOS attack. Attached A scrubbing service is provided to a network or device to mitigate the adverse effects of an attack on a destination device 110 .

[0026] As shown in FIG. 3, the destination device 110 may be connected to the Internet 108 through a scrubbing device, such as the small-scale scrubbing device 212. In general, the destination device 110 may be any network device, such as an application server or a storage server, for providing data or any other type of content to a requester through the Internet 108. Additionally, the destination device 110 may be more than one customer network device, creating a customer network of such devices, providing Internet data or content to a requesting device. The scrubbing architecture 120 may provide scrubbing services for all traffic intended for the destination device 110. For example, traffic intended for the destination device 110 from the Internet 108 may pass through the scrubbing environment 300 of FIG. 3 to remove potentially harmful communications associated with DDOS attacks and forward the traffic to the destination device 110. Reached In one example, a destination device 110 or a destination network administrator can use a scrubbing service provided by the IP network 102 to scrub out communication packets intended for the destination device 110 that are identified as malicious or otherwise part of a DDOS attack.

[0027] In one particular implementation of the scrubbing service of the network 102, the redirection of communication packets through the scrubbing architecture 120 may be initiated through a BGP or other routing protocol announcement. In particular, the destination device 110 or the destination network may announce through one or more BGP announcements the BGP or other routing protocol announcements associated with that device. Can be attachedThe destination device 110 may provide IP addresses to the network 102 and other connected networks. Traditionally, BGP announcements are provided by a device or network to assist the network in constructing a routing path to the device making the announcement. fart associated with network 102 to generate a scrub of the traffic Can be attached Build a Virtual Private Network (VPN) 322 Well done From this VPN 322, the destination device 110 of In this way, the VPN 322 can communicate with the destination device 110 via the BGP announcement. Hosting Scrubbing Architecture 120 The VPN 322 acts as a border network between the destination device 110 and the network 102. The routing information announced to the VPN 322 by the destination device 110 can propagate through other BGP sessions among other components of the network 102, such as between the VPN 322 and the clean router 304, from the clean router to the scrubbing architecture 120, from the scrubbing architecture to the dirty router 302, and from the dirty router 302 to the public network of the Internet 108. Cascade Type The route announcement establishes a routing path to reach the destination device 110 and at the same time provides scrubbing services to traffic intended for that device. Currently routed through Dirty Router 302, A communication packet addressed to the destination device 110 To start a scrubbing service for the communication packets Build a bypass route.

[0028] During routing of traffic intended for the destination device 110 along the communication line 310, the dirty router 302 may send communication packets for the destination device 110 to the scrubbing architecture 120 for analysis and scrubbing. Specifically, the scrubbing architecture 120 shown in FIG. 2 may include one or more large-scale scrubbing devices 206-210, one or more small-scale scrubbing devices 212-222, and / or one or more additional scrubbing devices, which may be arranged hierarchically based on the capabilities of the scrubbing devices, such as input bandwidth. Although the example of FIG. 3 shows three scrubbing devices (large-scale scrubber SD-A 206, small-scale scrubber SD-B 212, and SD-C 216), more or fewer scrubbers may be included in the scrubbing architecture 120. In some examples, a scrubbing controller 316 may also be included to control the configuration of the scrubbing devices in the architecture 120. In other examples, activities or operations of the controller 316 may be performed by the orchestrator 122 and / or a scrubbing device, as described in more detail below.

[0029] In general, a scrubbing device in the architecture 102 analyzes communication packets to determine whether such packets may be potentially malicious to a destination device, such as being part of a DDOS attack, and sends the packets to the destination device 110. Arrive As described in more detail below, the scrubbing controller 316 and / or orchestrator 122 can control the operation of the scrubbing devices of the architecture 120, for example by configuring the scrubbing devices with scrubbing profiles that instruct the scrubbing devices as to which scrubbing services to apply to received packets. toCommunication packets Incoming call stream teeth , sent to the clean router 304 Be Can be 、 The clean router 304 provides the stream of cleaned packets to the VPN 322 over the connection 320. The VPN 322 subsequently transmits the stream of cleaned packets to the destination device 110 for processing by the destination device 110. In this manner, through the scrubbing architecture 120, the destination device 110 to It can provide scrubbing of communication packets to mitigate DDOS attacks on destination devices.

[0030] The scrubbing devices of the scrubbing architecture 120 are provided with or otherwise have access to scrubbing information. This scrubbing information may be associated with the destination device 110 or the destination network. Attached IP address and the IP address Have The scrubbing information includes the type of scrubbing technique to be applied to the packets and other information that can configure the operation of the scrubbing device to provide scrubbing services. This information can be provided by the orchestrator 122 to the scrubbing controller 316 and / or the scrubber. In some examples, the orchestrator 122 can receive or access the scrubbing information or scrubbing profile from the database 306. Additionally, in some examples, the orchestrator 122 can be included in the network 102 to control the scrubbing information or scrubbing profile of the scrubber in the scrubbing architecture 120, as described in more detail below in connection with FIG. ProvisioningThe orchestrator 122 may automate or coordinate the configuration of the scrubbing architecture. In general, the orchestrator 122 may be any type of computing or networking device, such as an application server. In one implementation, the orchestrator 122 receives one or more route protocol advertisements from a network device (e.g., a BGP route advertisement for the destination device 110 received at the clean router 304) and, based on the received route protocol advertisements, Scrubbing Architecture 120 one or more of the scrubbing devices; or vinegar Configure the scrubbing controller 316. This configuration of the scrubbing architecture 210 can occur automatically in response to received route information, so that scrubbing services can be provided more rapidly and without manual entry of customer information into the scrubbing environment.

[0031] To illustrate the operation and use of the orchestrator 122, reference is now made to the method 400 of FIG. 4. FIG. 4 illustrates a method 400 for utilizing a multi-layer scrubbing architecture 120 of the network 102 to reduce the complexity and complexity associated with that architecture. Attached 4 is a flow chart illustrating a method 400 of providing scrubbing services in response to a potential DDOS attack on a device or network. In general, the operations of method 400 may be performed by the orchestrator 122 device discussed above. However, one or more of these operations may be performed by other networking or computing devices, such as a scrubbing device or a scrubbing controller. Additionally, orchestrator 122 may include more than one device for performing the operations of method 400. Through method 400, orchestrator 122 configures one or more aspects of scrubbing architecture 120 to respond to a detected DDOS attack and to provide scrubbing services to traffic affected by the attack. vinegar Clubbing services may be provided.

[0032] In Operation 402 Start , the orchestrator 122 is associated with the destination device 110 Attached, request scrubbing service Scrubbing Profile vinegar One or more small scrubbers 212 to 222 of the scrubbing architecture 120 Deliver As previously mentioned, a scrubbing profile may include an identification of one or more IP addresses, or a range of IP addresses, to which the scrubbing service should be applied. The profile may include the level of scrubbing, thresholds and rules for detecting harmful communication packets, actions to be taken upon detecting harmful communication packets, and the IP address-related actions for scrubbing. Attached Contains additional information such as a customer identifier Yo In some examples, the orchestrator 122 can obtain a profile from a database 306 in communication with the orchestrator, and some of the profiles can be Aspects and one or more small scrubbers 212 to 222 to Aspects can be provided.

[0033] Using the environment 200 of FIG. 2 as an example, the orchestrator 122 can provide the profile to one or more of the small scale scrubbers 212-222 of the scrubbing architecture 120 of the network 102. In one example, the profile is provided to one small scale scrubbing device (e.g., the small scale scrubber 212) of the architecture 120. Additionally, the orchestrator 122 can execute one or more rules to determine which of the small scale scrubbers 212-222 of the architecture 120 to provide the profile to. In one example, the small scale scrubber 212 determined to receive the profile can provide the profile to a destination device 110 that is to receive the scrubbed traffic. AgainstThe profile may be based on the geographic location of the small scale scrubber 212. Providing the profile to a small scale scrubber 212 that is geographically closer to the destination device 110 can shorten the transmission path between the small scale scrubber 212 and the destination device 110, thereby reducing latency in the scrubbing process. In another example, the orchestrator 122 can provide the profile to multiple small scale scrubbers 212 to 222 in the architecture 120, so that any of the small scale scrubbers can provide scrubbing services to the destination device 110.

[0034] In response to receiving the profile of the destination device 110 or destination network, the small scale scrubber 212 may Attached One or more IP addresses may be announced over the BGP session. As described above, announcing the IP addresses allows the small scale scrubber 212 to begin receiving packets intended for the destination device 110. The sending of packets to the small scale scrubber 212 may occur regardless of a detected DDOS attack on the destination device 110. Instead, all traffic intended for the destination device 110 may be scrubbed by the small scale scrubber 212 as a preventative measure against undetected DDOS attacks. but Yes, but there is no DDOS attack. During the period The traffic targeted to the destination device 110 is small. Ma or known It is okay Therefore, the bandwidth of the small-scale scrubber 212 is smaller than the scrubbing devices in other tiers of the scrubbing architecture 120. hand In other words, the input bandwidth to the small scrubber 212 can remain stable during periods outside of a DDOS attack, so that the input bandwidth to the small scrubber 212 can be smaller than during periods of a DDOS attack. hand good.

[0035] In an example where each small scrubber 212 to 222 receives a profile from the orchestrator 122, each receiving scrubber can announce the IP address identified in the profile. This can be an example of an anycast address where multiple devices in the network 102 announce the same IP address. In an anycast network, The multiple The devices can be configured to select the shortest possible route between devices, such that the small scale scrubber 212 that is geographically closest to the destination device 110 can receive traffic intended for the destination device 110. Destination devices or networks located in other areas can receive traffic from other small scale scrubbers 214-222 of the architecture 120 that are geographically closest to the destination device 110.

[0036] Thus, the small scale scrubbers 212 to 222 of the architecture 120 can provide an "always on" scrubbing service to devices or networks connected to the IP network 102. These small scale scrubbers 212 to 222 can: To prevent the destination device or network from receiving the packet, Cleaning packets that are identified as attack packets and not handle Identifying attack packets and the Mitigating Detection Corrective action may be determined by a profile provided to the small scale scrubbers 212 to 222. Can be attached A DDOS attack against a device or network may occur. To determine the occurrence of a DDOS attack, the small scale scrubbers 212-222 or other network devices may provide traffic data to the orchestrator 122 in operation 404. The traffic data may include the volume or bandwidth of traffic intended for a destination device 110 or a destination network connected to the IP network 102. YoOther traffic or network metrics may also be provided to the orchestrator 122 from other network sources. From these metrics, the orchestrator 122 can determine whether a DDOS attack is occurring.

[0037] In operation 406, the orchestrator 122 may Can be attached It may be determined whether the destination device 110 is experiencing a DDOS attack. In one example, this determination may be based on traffic data. For example, when the traffic bandwidth for the destination device 110 increases beyond a traffic flow threshold of the destination device 110, the orchestrator 122 To , it was determined that a DDOS attack was occurring. Let hand Yo For example, if a destination device 110 is sending data over 500 MB / s, fart traffic may indicate a DDOS attack. of Other thresholds may be considered, such as a percentage increase from a baseline data rate. Additionally, the threshold may vary by destination, such as one value for first destination device 110 and a second value for networks connected to IP network 102. Yo Regardless of the network data utilized to determine that a DDOS attack may be occurring, if a DDOS attack is not occurring, the orchestrator 122 may return to operation 404 and continue to access or receive network data. Yo During this period, the small scale scrubber 212 may continue to scrub traffic for the destination device 110.

[0038] If the orchestrator 122 determines, based on the network data, that a DDOS attack may be occurring, then in operation 408, the orchestrator 122 Ta Related to the attack Can be attachedIP addresses may be identified. For example, a network under attack may include several IP addresses in a contiguous or non-contiguous range. The orchestrator 122 may determine which IP addresses may be under attack based on an analysis of the network data. This determination may be made based on which destination IP address traffic has increased beyond the threshold discussed above. Thus, data received from the small scale scrubbers 212 to 222 may include destination IP addresses for packets received. Yo This allows the orchestrator 122 to Incoming call A metric for the communication packet may be identified.

[0039] In operation 410, the orchestrator 122 performs a process to identify the IP address associated with the attacked IP address. Can be attached Scrubbing profiles can be applied to large-scale scrubbers 206 to 210 or to other tiers of the scrubbing architecture 120. delivery As described above, the large-scale scrubber 206 can To begin receiving traffic intended for the destination device 110, In a BGP session or other address announcement, Under attack Destination device 110 I Announce your P address good Additionally, the orchestrator 122 can instruct one or more of the small-scale scrubbers 212 to 222 to stop announcing the attacked IP address, so that the small-scale scrubbers 212 to 222 stop receiving traffic for the destination device 110. In this manner, the attacked IP address of the destination device 110 can be of Traffic can be redirected from the small scale scrubber 212 to the large scale scrubber 206, which As shown in Figure 2, This is because traffic during a detected attack can be scrubbed by the large scale scrubber 206, and traffic during the period before or after a detected attack can be scrubbed by the small scale scrubber 212. The large scale scrubber 206 is ofDestination device 110 of Large volume Incoming call Traffic correspondence do For , configured with a larger input bandwidth than the small-scale scrubber 212 It is acceptable .

[0040] In this specification Illustrated However, the scrubbing architecture 120 may include other hierarchies corresponding to other thresholds. Yo This allows for a hierarchy of Can be attached Based on the threshold, the destination device 110 fart In this way, the destination device 110 can forward the traffic to the tier. fart The traffic is To deal with even larger incoming attacks moreover even more Large input bandwidth Have Scrubbing Device 120 layers of architecture Further, in one example, the large-scale scrubbers 206-210 (or any other scrubbers in the architecture 120) can be geographically based on known occurrences of DDOS attacks. source For example, some DDOS attacks on the network 102 may originate from a particular network or country. Larger scale scrubbers 206-210 can be located closer to the ingress point of the source of the DDOS attack in the network 102 to minimize or otherwise shorten the route that the attack packets take through the network 102. Thus, placing large scale scrubbers 206-210 closer to the ingress point of the source of the attack can help prevent attacks from reaching the destination device 110. Arrive In addition to scrubbing packets from reaching the network 102, the impact of attacks on the network 102 may be reduced (by shortening the period during which such packets are transmitted over the network 102).

[0041] Thus, packets intended for the destination device 110 or the destination network of By analyzing the traffic, it is possible to redirect the traffic from the small scrubber 212 to the large scrubber 206 during a DDOS attack. Incoming call Because the bandwidth requirements for handling the traffic may be greater than during periods when no attacks are occurring, the large scale scrubber 206 is configured to have an input bandwidth greater than that of the small scale scrubber 212. Yo The large scale scrubber 206 may have other performance capabilities (such as greater memory and processing capabilities) that improve the scrubbing performance of the large scale scrubber 206 compared to the small scale scrubber 212. Furthermore, the transmission of the large scale scrubber 206 from the small scale scrubber 212 to the destination device 110 may be fart of Incoming call Traffic redirection can be based on a number of different criteria, including bandwidth thresholds measured in bytes per second. Incoming call Traffic related Can be attached This may occur in response to network performance metrics. Thus, as the flow of traffic to a destination device 110 increases due to a DDOS attack on that destination device, scrubbing services may shift from the small scale scrubber 212 to the large scale scrubber 206, Incoming call It can be ensured that an increase in traffic does not overwhelm the scrubbing service. Multiple tiers of scrubbers can be included in the scrubbing architecture 120 to deliver various threshold levels of traffic to the destination device 100 or destination network. Incoming call It can handle traffic.

[0042] In operation 412, the orchestrator 122 may continue to monitor traffic intended for the destination device 110 or the destination network. Can be attached The network data may be received from a scrubber of the scrubbing architecture 120 or from another source on the network 102 configured to provide traffic data to the orchestrator 122. In operation 414, the orchestrator 122 may determine whether the DDOS attack on the destination device 110 is continuing or has ended. fartThe DDOS attack may be determined to have ended when the traffic drops below the threshold that caused the redirection of traffic to the large scale scrubber 206. In another example, the network metric threshold for determining that the DDOS attack has ended may be different than the threshold for determining that the DDOS attack has begun. Yo Regardless of the threshold used, the orchestrator 122 will notify the attacker of the attack if a DDOS attack is occurring. of To monitor traffic intended for a destination device 110 of The process may return to operation 412.

[0043] If the orchestrator 122 determines that the DDOS attack has ended, or if traffic targeted to the destination device 110 has otherwise dropped below a network metric threshold, the orchestrator 122 may generate a metric for the IP address associated with the attacked IP address. Can be attached The scrubbing profile may be applied to the small-scale scrubber 212 or other tiers of the scrubbing architecture 120. delivery As described above, the small-scale scrubber 212 can To receive traffic intended for the destination device 110, Re-announce the IP address of the destination device 110 in a BGP session or other address announcement. good In addition, the orchestrator 122 may: so that the mass scrubbers 206 to 210 stop receiving traffic for the destination device 110. Instruct one or more of the mass scrubbers 206 through 210 to stop announcing the attacked IP address of the destination device 110. May In this way, the IP address of the destination device 110 fart Traffic teeth , and then returned to the small-scale scrubbers 212 to 222 for scrubbing by the small-scale scrubbers 212 to 222 of the architecture 120. It is acceptable .

[0044] Through the above method 400, traffic intended for the destination device 110 can be scrubbed by the small scale scrubbing devices 212-222 during normal operation or before or after a DDOS attack on the device 110. However, D DOS attacks Detection of In some cases, traffic to the destination device 110 may be forwarded to a large-scale scrubber 206-210 that has a relatively large input bandwidth and / or other performance capabilities. The large-scale scrubbers 206-210 may: During a DDOS attack Destination Device 110 or Destination Network Incoming calls to The packets may be scrubbed. After the attack is over, the traffic may be returned to be scrubbed by the small scale scrubbers 212 to 222. Similarly, other tiers of scrubbing devices may be included in the scrubbing architecture 120 to provide a scalable and versatile scrubbing environment for the network 102 to provide scrubbing services to devices and / or networks connected to that network.

[0045] In another example, the small scale scrubbing devices 212 to 222 may include a VPN 322 By , or any other network in communication with the clean router 304 By host Will be Scrubbing services can be provided to multiple destination devices 110. 2 or more DDOS attacks can occur simultaneously. Each DDOS attack is directed to a large-scale scrubber 206 through 210. escalation Therefore, in some implementations, the small-scale scrubbing devices 212 to 222 may not be sufficient to cause multiple destination devices 110 to Addressed to Analyze the traffic and analyze the traffic across these multiple devices. above Configured to determine DDOS attacks It is okay . The Multiple Destination Devices aboveWhen an attack is detected, the small scale scrubbing devices 212 to 222 are notified of the attack as described above. The device of Traffic can be forwarded from the mass scrubber 206 to the mass scrubber 210. Thus, in this example, multiple destination devices Addressed to traffic but analysis Be ,network above Potential DDOS attacks but detection It is acceptable .

[0046] 5 is a block diagram illustrating an example of a computing device or computer system 500 that can be used in implementing embodiments of the components of the network disclosed above. For example, the computing system 500 of FIG. 5 may be the orchestrator 122 discussed above. The computer system (system) includes one or more processors 502-506. The processors 502-506 may include one or more of An internal level cache (not shown) and a processor bus 512 Send a conversation A processor bus 512, also known as a host bus or front side bus, may be used to couple the processors 502 through 506 to a system interface 514. The system interface 514 may include a bus controller or bus interface unit for connecting the processors 502 through 506 to a processor bus 512, also known as a host bus or front side bus. teeth , other components of system 500 and Processor bus 512 and of Take the interface may be connected to the processor bus 512 for For example, the system interface 514 may include a main memory 516 and Processor bus 512 and of The system interface 514 may include a memory controller 518 for interfacing with one or more I / O bridges or I / O devices. The main memory 516 typically includes one or more memory cards and control circuitry (not shown). and Processor bus 512 and ofIt may also include an input / output (I / O) interface 520 for interfacing with one or more I / O controllers and / or I / O devices, such as an I / O controller 528 and an I / O device 530, may be connected to the I / O bus 526 as shown.

[0047] The I / O devices 530 may also include input devices (not shown), such as an alphanumeric input device including alphanumeric and other keys for communicating information and / or command selections to the processors 502 through 506. Other types of user input devices include a mouse, a trackball, or a cursor control, such as cursor direction keys for communicating directional information and command selections to the processors 502 through 506 and for controlling cursor movement on a display device.

[0048] The system 500 may include a dynamic storage device referred to as a main memory 516, or random access memory (RAM) or other computer-readable device coupled to the processor bus 512 for storing information and instructions to be executed by the processors 502 to 506. The main memory 516 may also be used to store temporary variables or other intermediate information during execution of instructions by the processors 502 to 506. The system 500 may include a read-only memory (ROM) and / or other static storage device coupled to the processor bus 512 for storing static information and instructions for the processors 502 to 506. The system illustrated in FIG. 5 is just one possible example of a computer system that may be used or configured in accordance with aspects of the present disclosure.

[0049] According to one embodiment, the above techniques may be performed by computer system 500 in response to processor 504 executing one or more sequences of one or more instructions contained in main memory 516. These instructions may be read into main memory 516 from another machine-readable medium, such as a storage device. Execution of the sequences of instructions contained in main memory 516 may cause processors 502 through 506 to perform the process steps described herein. In alternative embodiments, circuitry may be used in place of or in combination with software instructions. Thus, embodiments of the present disclosure may include both hardware and software components.

[0050] A machine-readable medium includes any mechanism for storing or transmitting information in a form (e.g., software, processing application) readable by a machine (e.g., a computer). Such media may take the form of, but are not limited to, non-volatile and volatile media, and may include removable data storage media, non-removable data storage media, and / or external storage devices made available via wired or wireless network architectures with computer program products, including one or more database management products, web server products, application server products, and / or other additional software components. Examples of removable data storage media include compact disc read-only memory (CD-ROM), digital versatile disc read-only memory (DVD-ROM), magneto-optical disks, flash devices, and the like. Examples of non-removable data storage media include internal magnetic hard disks and SSDs, and the like. The one or more memory devices 606 may include volatile memory (e.g., dynamic random access memory (DRAM), static random access memory (SRAM), and the like) and / or non-volatile memory (e.g., read-only memory (ROM), flash memory, and the like).

[0051] The above description includes exemplary systems, methods, techniques, instruction sequences, and / or computer program products that implement the techniques of the present disclosure. However, it is understood that the described disclosure can be practiced without these specific details. In the present disclosure, the methods of performing the disclosure can be implemented as a set of instructions or device-readable software. Furthermore, it is understood that the specific order or hierarchy of steps in the methods of performing the disclosure is an example of an exemplary approach. Based on design preferences, it is understood that the specific order or hierarchy of steps in the methods can be rearranged while remaining within the disclosed subject matter. The accompanying method claims present elements of the various steps in a sample order and are not necessarily limited to the specific order or hierarchy presented.

[0052] It will be believed that the present disclosure and many of its attendant advantages will be understood from the foregoing description, and it will be apparent that various changes can be made in the form, construction and arrangement of the components without departing from the disclosed subject matter or sacrificing all of its material advantages. The described forms are merely illustrative, and it is the intent of the following claims to embrace and include such modifications.

[0053] Although the present disclosure has been described in relation to various embodiments, it should be understood that all of these embodiments are illustrative and that the scope of the disclosure is not limited thereto. Many variations, modifications, additions, and improvements are possible. More generally, the embodiments according to the present disclosure have been described in the context of specific implementations. Functions may be separated into blocks or combined in different ways or described with different terms in various embodiments of the present disclosure. These variations, modifications, additions, and improvements, as well as other variations, modifications, additions, and improvements, may be included within the scope of the disclosure, as defined in the following claims. [Other possible items] (Item 1) 1. A method for providing a scrubbing service from a network, comprising: receiving, in response to a denial of service attack on a device of a telecommunications network, routing information associated with the device over a first routing protocol announcement session, the routing information having an Internet Protocol (IP) address associated with the device; associating the IP address with a customer profile in a scrubbing environment of the telecommunications network, the scrubbing environment providing traffic scrubbing services to customers of the telecommunications network; In response to the received routing information for the device of the telecommunications network, a scrubbing device of the scrubbing environment is notified of the scrubbing information of the device of the telecommunications network. Will be sending an instruction to add the IP address to a list of IP addresses over the first routing protocol announcement session; A method for providing the above. (Item 2) modifying the received routing information; announcing the modified received routing information to routers of the telecommunications network through a second routing protocol announcement session; Item 1. The method of item 1, further comprising: (Item 3) 3. The method of claim 2, wherein the first routing protocol announcement session and the second routing protocol announcement session each include a Border Gateway Protocol (BGP) announcement session in the telecommunications network. (Item 4) In the customer profile of the scrubbing environment at least obtaining a customer mask scrubbing state of the scrubbing environment based on the customer mask scrubbing state associated with the device; Can be attachedThe IP address of having a stored indication of the scrubbing status; Item 1. The method of item 1, further comprising: (Item 5) the customer mask scrubbing state of the scrubbing environment does not indicate an existing customer profile stored with the scrubbing environment, and the instructions create a customer profile in the scrubbing environment associated with the IP address of the device. Can be attached The method according to item 4, further comprising constructing a scrubbing customer profile. (Item 6) accessing a database of customer information for said telecommunications network, said customer information being associated with each customer for said telecommunications network; Can be attached Having multiple IP addresses, Item 1. The method of item 1, further comprising: (Item 7) 2. The method of claim 1, wherein the scrubbing environment comprises a scrubbing controller and a plurality of scrubbing servers, the scrubbing controller providing scrubbing instructions to the plurality of scrubbing servers for providing the traffic scrubbing service to the customers of the telecommunications network. (Item 8) The instructions include: Between , said at least one IP address of Scrubbing Service of load To disperse load dispersion 8. The method of claim 7 further comprising instructions. (Item 9) The instructions include instructions to the scrubbing controller to scrub the scrubbing device of the scrubbing environment if the IP address associated with the device is no longer announced by the device. Will be 8. The method of claim 7, further comprising removing the IP address of the device from the list of IP addresses. (Item 10) 1. An orchestrator device for a scrubbing environment for a telecommunications network, comprising: The orchestrator, at least one communication port that receives routing information through a first routing protocol announcement in response to a detected denial of service attack on the device, the routing information having at least one Internet Protocol (IP) address associated with a device of the telecommunications network; A processing device; a computer readable medium coupled to the processing device; Equipped with The computer-readable medium is configured to store information and instructions that, when executed by the processing device, an operation of associating the at least one IP address with a customer profile of the scrubbing environment of the telecommunications network, the scrubbing environment providing traffic scrubbing services to customers of the telecommunications network; an operation of obtaining a customer mask scrubbing state of the scrubbing environment based on at least the customer profile of the scrubbing environment, the customer mask scrubbing state having an indication of a stored scrubbing state for the IP address associated with the device; scrubbing at least one scrubbing device of the scrubbing environment in response to the received routing information for the device of the telecommunications network. Will be sending one or more instructions to the scrubbing environment via the first routing protocol announcement to add the at least one IP address to a list of IP addresses; Execute Orchestrator device. (Item 11) The information and instructions, when executed by the processing device, modifying the received routing information; announcing the modified received routing information to routers of the telecommunications network through a second routing protocol announcement; Further execute Item 11. The orchestrator device of item 10. (Item 12) the first routing protocol announcement and the second routing protocol announcement each include a Border Gateway Protocol (BGP) announcement session within the telecommunications network; Item 12. The orchestrator according to item 11. (Item 13) the customer mask scrubbing state of the scrubbing environment does not indicate an existing customer profile stored with the scrubbing environment, and the one or more instructions further establish, within the scrubbing environment, a scrubbing customer profile associated with the at least one IP address of the device. Item 11. The orchestrator according to item 10. (Item 14) the scrubbing environment comprises a scrubbing controller and a plurality of scrubbing servers, the scrubbing controller providing scrubbing instructions to the plurality of scrubbing servers for providing the traffic scrubbing service to the customers of the telecommunications network; Item 11. The orchestrator according to item 10. (Item 15) The one or more instructions include instructions for: Between , said at least one IP address of Load of the scrubbing service dispersion Do For load dispersion further comprising the instructions: Item 15. The orchestrator according to item 14. (Item 16) 1. A method of operating a telecommunications network, comprising: receiving a device identifier from a device undergoing a denial of service (DOS) attack, the device identifier being received through a first routing protocol announcement session for the device; scrubbing a scrubbing device of the scrubbing environment in response to the received device identifier of the device; Will be sending an instruction to a scrubbing environment over the first routing protocol announcement session to add the device identifier to a list of device identifiers; A method for providing the above. (Item 17) the device identifier is an Internet Protocol (IP) address; Item 17. The method according to item 16. (Item 18) associating the device identifier with a customer profile of a scrubbing environment of the telecommunications network, the scrubbing environment providing traffic scrubbing services to customers of the telecommunications network. Item 17. The method according to item 16. (Item 19) modifying the device identifier; announcing the modified device identifier to a router of the telecommunications network through a second routing protocol announcement session; 17. The method of claim 16, further comprising: (Item 20) the first routing protocol announcement session and the second routing protocol announcement session each include a Border Gateway Protocol (BGP) announcement session within the telecommunications network; Item 19. The method according to item 19.

Claims

1. 1. A method for providing a scrubbing service from a network, comprising: receiving, from an orchestrator of the network, at a scrubbing device of a plurality of scrubbing devices of a scrubbing environment, a scrubbing profile associated with a device of a telecommunications network through a routing protocol announcement session, the scrubbing profile including an Internet Protocol (IP) address associated with the device; announcing, by the one scrubbing device, the IP address associated with the device over a Border Gateway Protocol (BGP) announcement session in response to receiving the scrubbing profile; determining, by the orchestrator, that each of a plurality of denial of service attacks is occurring on the device, and determining whether each of the determined attacks is greater than a threshold associated with one of the scrubbing devices; In response to each of the determinations that an attack occurred while the one scrubbing device was instructed to perform the announcement and that the attack is greater than the threshold associated with the one scrubbing device, sending, by the orchestrator, the scrubbing profile of the device of the telecommunications network to another scrubbing device of the plurality of scrubbing devices of the scrubbing environment; instructing the one scrubbing device instructed by the orchestrator to perform the announcement to stop announcing the IP address associated with the device; announcing, by the other scrubbing device, the scrubbing profile sent by the orchestrator over a second routing protocol announcement session; the other scrubbing device has a larger input bandwidth than the one scrubbing device that has been instructed to stop announcing; method.

2. The method of claim 1 , wherein each of the routing protocol announcement sessions comprises a Border Gateway Protocol (BGP) announcement session in the telecommunications network. [0013] The method further comprises retrieving, by the orchestrator, the scrubbing profile from a database, retaining some aspects of the scrubbing profile, and providing other aspects of the scrubbing profile to the one scrubbing device. The method according to claim 1 or 2.

4. The method of claim 1 or 2, wherein the scrubbing environment further includes a scrubbing controller, the scrubbing controller providing scrubbing instructions to the plurality of scrubbing devices for providing traffic scrubbing services to customers of the telecommunications network.

5. 1. An orchestrator device for a scrubbing environment for a telecommunications network, comprising: at least one first communication port configured to receive routing information through a first routing protocol announcement, the routing information including at least one Internet Protocol (IP) address associated with a device of the telecommunications network; at least one second communication port configured to receive the routing information through a second routing protocol announcement in response to detecting a denial of service attack on the device; a processing device, the processing device being configured to: an operation of sending, via the first routing protocol announcement to a scrubbing device of a plurality of scrubbing devices in the scrubbing environment, a scrubbing profile associated with the device, the scrubbing profile including the IP address associated with the device; determining that each of a plurality of denial of service attacks is occurring on the device and determining whether each of the determined attacks is greater than a threshold associated with the one scrubbing device; In response to each of the determinations that an attack occurred while the one scrubbing device was instructed to perform the announcement of the IP address associated with the device, and that the attack is greater than the threshold associated with the one scrubbing device, transmitting the scrubbing profile of the device of the telecommunications network through the second communication port to another scrubbing device of the plurality of scrubbing devices of the scrubbing environment; and instructing the one scrubbing device that has been instructed to perform the announcement to stop announcing the IP address associated with the device; The other scrubbing device has a larger input bandwidth than the one scrubbing device.

6. the first routing protocol announcement and the second routing protocol announcement each include a Border Gateway Protocol (BGP) announcement session in the telecommunications network; The orchestrator device of claim 5 .

7. the scrubbing environment further comprising a scrubbing controller, the scrubbing controller providing scrubbing instructions to the plurality of scrubbing devices for providing traffic scrubbing services to customers of the telecommunications network; An orchestrator device according to claim 5 or 6.

Images