HNC2014_企业信息安全_华为运营商安全方案_易建超

华为运营商安全解决方案易建超华为企业网络产品线产品总监

运营商安全所面临的挑战及投资驱动力

⏹降低设备运行故障时间

⏹抵御显著增加的垃圾邮件内容 ⏹抵御显著产生的安全攻击威胁 ⏹提高抵御未知威胁能力 ⏹保护客户数据防止窃取

⏹适应显著上升的骨干网络流量 ⏹适应移动网络流量增长趋势 ⏹数据中心升级扩容

⏹基于云的安全解决方案诉求 ⏹增加新的收入来源

⏹

保证原有服务的持续竞争力

威胁防护

隐私保护

网络发展

增加收益

安全威胁增多 用户隐私泄露

网络不断演进 盈利能力有限

面向大数据流量的下一代安全

Solution

Ability

Topic

数据中心安全 管道安全 IT 信息安全 安全运营

FBB MBB LTE CGN AntiDDoS

身份安全 数据安全 虚拟化安全 网络与边界安全

防攻击 防泄密 防特权

安全增值

华为安全能力和愿景

华为安全案例

1Clean Pipe 管道安全

运营商当前网络威胁

Cloud

Core & IGW

Metro & Core

Terminal & Access

Enterprise Finance Metro

NPE

PE

PE

IP/MPLS

Core

2G BTS

3G NodeB 4G eNodeB

Backhaul

SGSN GGSN

PS domain

EPC

BSC/RNC IP/MPLS

Core

Internet

IDC

IPTV

IMS

Traffic

Interception

P

P

BRAS

Unauthorized

Access

SCTP

Vulnerability

DDoS Attack

Worm, Trojan,

Virus

Untrust

Traffic

IPv4 Exhaustion

Worm, Trojan, Virus

DDoS Attack

Worm, Trojan,

Virus

IPv4

Exhaustion

管道网络升级

MBB 管道安全 华为“ Clean Pipe ” 管道安全方案

FBB 管道安全

安全域隔离 固网DDOS 防护

LTE IPSec 加密 SCTP 安全防护 移动网DDOS 防护 SGi 安全防护

CGN 和日志溯源

华为运营商固定网络防护

PE-AGG

HG

Access Node

DSLAM

BRAS

BRAS

HG

NPE

Access

Internet

Head-end

VoD Server

TERMINAL

ACCESS

METRO CORE & IGW Metro

PE-AGG

NPE

Business

Corporate

CPE

CLOUD

GPON

Access

•NAT44/NAT444

•DS-Lite/NAT64/6RD

IPv6 Migration

Anti-DDoS

Access Sec

•Firewall for unauthorized access

•TCP Flood/UDP Flood •HTTP Flood •HTTPS DDoS

Core

P

P

ISP-PE

ISP-PE

华为运营商移动网络防护

SGW

IMS

Non-Trusted Domain

Firewall

EPC Trusted Domain

IP Backhaul

Non-Trusted Domain

IP Transport Core

Internet

NMS

SeGW

•SCTP packets flooding and SCTP state checking.

SCTP Sec

SGi Protection

IPsec

•Illegal devices access

•Signal and user traffic leakage

•Intrusion from internet

attack.

•Exhaustion for limitation public IP resource.

IPv6 Evaluation

华为CGN 解决方案

2010 IPv6 commercial

Internet scale

IPv4 address

2016

Initialing

Developing

Developed

2012 2014 Network development needs IPv6Network development needs IPv6

IPv4IPv4

IPv4IPv4

& IPv6IPv6

IPv6IPv6

Evaluation of network Evaluation of network

.

• IPv4 firewall

• Carrier grade NAT

• IPv4/IPv6 Dual-stack FW • NAT444

•IPv6 DDoS •DS-Lite

•IPv6 IPS •NAT64

IPv6 internet

IPv4 internet

v4

v4

v4 v6 v4 v6 v6 v4

v6

v4

v4

v4

v4

华为运营商管道网络升级