100GBPS, ULTRA-FAST, CERTIFIED HIGH- ASSURANCE NETWORK ENCRYPTION FOR MEGA DATA

Transcription

1 100GBPS, ULTRA-FAST, CERTIFIED HIGH- ASSURANCE NETWORK ENCRYPTION FOR MEGA DATA Common use case scenarios for 100Gbps certified high-assurance encryption security demanding full line-rate network performance. WHO SHOULD READ THIS DOCUMENT Layer 2 Data Network Managers and Support staff, Cloud and Data Centre Network Architects, Big Data Professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers and Data Security Procurement Staff, Cloud and Data Centre Managers, Cloud and Data Centre Security Professionals. KEYWORDS Layer 2 Data Networks, Big Data Networks, 100Gbps Data Networks, High-Assurance Encryption, Ethernet Encryption, Network Data Encryption Hardware, High Speed Data Networks, Network Data Security, Encryption Data Security, Network Data Encryption, Certified Layer 2 Network Encryptors, High-Assurance Network Encryptors, 10Mbps, 100Mbps, 1Gbps, 10Gbps and 100Gbps Data Encryptors. Big Data, Mega Data, Cloud Data Centre Security, Full Line-Rate, Ultra-Low Latency, Ultra-Fast Network Encryption.

2 Use cases and case studies for Senetas CN9000 Series 100Gbps encryptors. Certified highassurance encryption and ultralow latency; protecting mega data network applications. Senetas CN Gbps encryption in action For the first time, certified high-assurance 100Gbps Ethernet network encryption is a reality. Not just fast, but ultra-fast, not just Big Data, but Mega Data across all topologies. What does 100Gbps look like? Imagine encrypting, transmitting and decrypting 20,000 HD streaming movies in just one second! Or, streaming the entire contents of your local library in just one second. This is the power of the Senetas CN9000 series encryptors: ultra-fast, ultra-secure, ultra-reliable performance; every second, every minute, every hour and every day. CN9000 encryptors represent the very best in electronics engineering, data network security R&D, ultra-fast 100Gbps bandwidth performance and future-proof data security. Senetas and its global distribution partner, Gemalto, have collaborated with Cloud and data centre service providers; national governments; telecommunications, Cloud and data centre service providers and leading commercial enterprises in three continents to plan the future of ultra-fast data network security. Recognising the impact of Big Data and the Internet of Things, stakeholders understood that as bandwidth and data volumes increase, so does risk. Planning centred on the need for robust, high-assurance network data security; but without compromising ultra-fast network performance. Cloud and data centre service providers acknowledge that data network security is not negotiable and will be a core component of enterprise, government and service provider network planning in a Big Data, or mega data, world. "The Senetas CN9000 series is the first commercially available range of certified high-assurance 100Gbps Ethernet encryptors that support the most complex fully meshed topologies - enabling 100% security for Big Data, Cloud and data centre services ultra-fast networks".

3 Why 100Gbps? The first commercially available 100Gbps fibre network implemented in the USA was in Cleveland, Ohio. The network was the result of a collaborative effort to meet the exacting demands of the world s fastest bandwidth network within the wellknown Cleveland Health-Tech Corridor. The business imperative was simple. The campuslike (data network) collaboration of scientific, medical, research and related Big Data analytics demanded 100Gbps bandwidth speed to: > Deliver business and economic growth advantages > Enable high-tech and innovation development > Meet the needs of scientific research organisations > Provide a platform for advanced health-care > Enable the best technology infrastructure for Big Data, data centre, and Cloud service providers Using the first US Carrier-provided 100Gbps fibre network links, these data-intensive organisations continue to report significant ROI benefits: > Real-time collaboration using hi-resolution medical images is speeding up diagnoses and helping to save lives > Scientific research & development is accelerated with instant access to mega data and analytics > Enabling next-generation video streaming by overcoming bandwidth barriers to 4D, holographic and immersive video > Real-time data mining and multi-dimensional analytics enables emerging Big Data apps such as genomics and UHD medical imaging > Virtualization and convergence of data storage and data networks enabling instantaneous access to long term stored and archived mega data. However, the development of high-profile, ultra-fast networks and high-value mega data links expose the collaborating partners to a significantly increased risk of cyber-attack. All 100Gbps networks have similar security threat profiles and demand certified high-assurance network data encryption security if they are to be fully protected from an array of cyber-threats, including: > Eavesdropping > Intellectual property theft > Rogue data attacks > Financial harm > Redirection of sensitive data > Technical or human errors > Vulnerable network devices. 100Gbps encryption needs Throughout the partner, customer and service provider engagement process, six key requirements kept coming up as being non-negotiable. 1. Any solution must provide robust highassurance^ network security, and preferably certified by a recognized independent testing authority 2. Robust encryption must not interfere with 100Gbps network and link bandwidth and application performance 3. Anything but consistent, ultra-low latency would not be acceptable because of the real-time nature of applications 4. Future-proof investment and ROI, including interoperability with similar lower bandwidth solutions 5. Support for all 100Gpbs Layer 2 Ethernet topologies 6. Any data overheads caused by the encryption solution must be as low as to be immaterial 7. The solution s total cost of ownership (TCO) profile including overheads must be efficient. ^ Click here to read more about criteria for high-assurance Ethernet network encryption.

4 100Gigabit Use cases The exponential growth in data volumes has led to a corresponding demand for ultra-fast data networks. 100Gbps Carrier and dark fibre networks enable cost-effective and efficient data transfers among data centre locations for a range of Big Data analytics and applications. Whilst many customer and service provider 100Gbps use cases share similarities, it is where they differ that highlights the unique feature set of the CN9000 encryptors. Until recently ultra-fast network links were largely the domain of data centre-to-data centre and location-to-location applications a simple pointto-point network topology. Today, this ultra-fast bandwidth demand is increasingly driven by more complex applications, such as Cloud and data centre services; campus Big Data aggregation, sharing and storage and more complex data aggregation architectures. The issue for high-assurance encryption of ultrafast networks and links is the need to support complex network topologies in particular, various multi-point, fully meshed and hub-andspoke architectures. This support for all network topologies also makes Senetas CN9000 Series encryptors stand out. Use case 1 High-assurance network security for a simple 100Gbps point-to-point data centre to data centre service provider an ultra-fast performance network requiring maximum data security. This data centre-to-data centre application enables safe and highly cost and performance efficient data back-up and multi-redundancy disaster recovery capability. A key advantage offered by the CN9120 is the QSFP28 interface for up to 80kms signal transmission enabling optimal MAN performance and benefiting the service provider through savings on the cost of additional OTN network hardware that would otherwise be necessary. Use case 2 Senetas CN9000 Series encryptors support for all Layer 2 topologies is something no other vendor may claim today. Consequently, support for multipoint-to-multi-point campus-style networks and topologies offer a major customer benefit. In this campus network, research, scientific and medical mega data is captured, aggregated, shared and analyzed in real time. Ultra-low latency (a customer environment average of just 1.5 micro-seconds) and no detectable bandwidth loss on data encryption overhead ensures real-time collaboration. Use case 3 For a large-scale, international Cloud computing service provider, CN9100 encryptors provide maximum backbone security for the delivery of a range of Software-as-a-Service (SaaS) solutions. The 100Gigabits Journey in 1 second This increasingly important use case typically requires multi-point or hub-and-spoke network topologies. It is where no other high-assurance 100Gbps solution is likely to offer a solution. Cloud and SaaS service providers are aware that enterprise and government customers are riskaverse. They demand high-assurance encryption security and ultra-low latency. In this instance, 10/25/40Gbps links are aggregated for single 100Gbps link data transmission. Network topologies for data aggregation can also be complex. These customers are also aware that if today s 100Gbps high-assurance mega data network encryption solution only supports limited topologies; their investment may become redundant in the short term.

5 Use case 4 Multiple data centre-to-data centre applications supporting both mega data Cloud, data storage and back-up services often requires a hub-and-spoke network topology. Both private and (public) service provider use cases for 100Gbps links within such networks often comprise multiple topologies. These customers prefer support for all topologies to ensure a flexible and cost effective solution. Additionally, within the overall data network there will be a variety of link bandwidth speeds from modest 100Mbps to high speed 1Gbps and 10Gbps. Customers prefer or demand that all the vendor s encryptors are 100% interoperable. The Senetas interoperability extends well beyond among current products, to fully backward compatible. Here ultra-low latency, near-zero data overheads and support for all topologies may be necessary to fully meet customer requirements. This use case highlights typical total cost of ownership (TCO) and return on investment (ROI) requirements that are met by the CN9000 Series. Use case 5 A large scale, global Cloud services provider s ultra-fast network infrastructure backbone linking major customer locations; internationally distributed data centre facilities; and a wide range of SaaS delivery locations. The customers business case included three competing requirements: > Maximum high-assurance encryption security > No detectible reduction in network performance > Future-proof and end-to-end network interoperability investment from ultra-fast, to high-speed to modest Layer 2 network links, supporting all topologies. In this use case, maximum data security and network performance were pre-requisites. Also, because of the sensitive nature of the data carried by Government customers, the solution needed to be certified as suitable for government or defence applications. Use case 6 Commercial provision of 100Gbps national and international fibre network links to enterprise and government customers. In this instance, the customer s 100Gbps links were used to support SaaS, Cloud-based mega data applications and data centre interconnect services. Additionally, the customer already encrypts Layer 2 Carrier Ethernet 10Gbps and 1Gbps links to meet government customers requirements for FIPS certified high-assurance network data encryption security. The certified high-assurance encryption of the 100Gbps backbone links is provided by Senetas CN9100 and CN9120 (WAN and MAN respectively) encryptors. Similarly, the 1Gbps and 10Gbps high speed links are protected by Senetas CN6010 and CN6100 encryptors respectively. In addition to certified high-assurance requirements, it was essential that the Senetas solutions provided: > 100% encryptor interoperability among CN6000 and CN9000 Series encryptors and any future Senetas CN products implemented > Support for all topologies by all CN Series encryptors > The same crypto-agility and Quantum ready features among all CN Series encryptors > Flexible multiple topology support within the overall architecture. The service provider s multiple data centre-todata centre data transmission and aggregation and storage and back-up are included in the complex network architecture.

6 Support for all topologies Whatever the chosen network topology and technology use case, Senetas CN9000 Series encryptors ensure maximum 100Gbps security for Big Data, Cloud and data centre applications across point-to-point, multi-point and fully meshed network topologies. Data Centre Interconnect & 100 Gbps network links Link topology Data Centre or Location 1 CN9000 Encryptor Dark Fibre or Carrier Link up to 80kms* *Using QSFP-28 DWDM transceiver or using SFP4 transceiver (up to 10kms) CN9000 Encryptor Data Centre or Location 2 MAN topology Metro Area Network (hub-spoke) eg: Cloud Services Meshed topology Campus Full Mesh Area Network e.g. Research Institute, Defence Establishment or University Building A Building B 100Gbps Ethernet Root 100G Encrypted High Speed Backbone Leaf Leaf Leaf Building C Building D Using QSFP-28 DWDM transceiver (up to 80 kms) Using QSFP-28 DWDM and/or CFP4 transceivers

7 Use case outcomes The certified high-assurance security capabilities of the CN9000 Series encryptors have operated without any measurable network performance compromise in either customer use case. In both the customer and service provider use cases, two network performance measures have been beneficial and supported the 100Gbps networks business cases: Ultra-low latency. In all practicalities, the experiences have been real time with consistent latency at approximately 1.5 micro-seconds. Near-zero data overheads. Senetas technology fully meets the customer performance and security demands without compromising bandwidth availability. Like all Senetas CN encryptors, the CN9000 series platform provides high-assurance security and full line-rate transparent encryption for data transmitted across dark fibre, metro area, local area and wide area Ethernet networks in all topologies. The state-of-the-art, automatic zero-touch encryption key management capability in all Senetas CN encryptors removes the reliance upon external key servers; providing a robust, fault-tolerant security architecture. The secure and tamper-proof chassis also gives uncompromising protection to key material held in the encryptor. Standards based encryption algorithms are also essential for high-assurance. In all these cases AES256 has been the standard. Full interoperability among all Senetas CN series encryptors provides end-user customers with peace of mind not often available from other network encryption solutions. Designed-in crypto-agility and solution flexibility is a hallmark of the entire CN Series range. The flexible and efficient FPGA architecture enables flexibility of custom solutions and advanced future-proof crypto-agility. With Quantum computing on the horizon, unnecessary redundancy is eliminated by the CN Series encryptors Quantum ready features. 100% network device compatibility allows all customers and partners to standardise on one platform. This has resulted in both low TCO and high ROI quite a rare experience with technology products. From the outset, both variants of the CN9100 encryptors proved their security and network performance - in partner testing and in customer proof of concept deployments well beyond simple lab testing. As Senetas security aware customer organisations seek to maximize their secure mega data, Cloud Computing and data centre solutions, they are also sensitive to the need for both certified high-assurance encryption and maximum 100Gbps network performance. End-to-end authenticated network data encryption is essential to high-assurance solutions. This ensures that even at 100Gbps ultra-fast bandwidth speed there is never a point or hop at which data is not 100% protected.

8 Certified high-assurance encryption security Each customer and partner use-case application of 100Gbps network security highlights the need to satisfy all stakeholder requirements for certified, high-assurance encryption security. Government and government customers mandates for security product certification (FIPS or Common Criteria); and non-government organisations increasing preference for certification, in addition to high-assurance product features, are driven by network data security policies. The Senetas CN9000 Series encryptors referred to in the use cases, customer case studies and testing environments were the CN9100 and CN9120, both of which meet two important security requirements: Firstly, they deliver against the four essential high-assurance criteria: > State-of-the-art, automatic zero-touch key management > Dedicated, secure and tamper-proof hardware Certifications in depth In addition to the CN9000 Series high-assurance security credentials, Senetas is committed to certifications in depth. This refers to Senetas s near 20-year R&D commitment to product certification by multiple independent international testing authorities. These certifications provide enterprise customers and government customers alike with the assurance that all Senetas CN encryptors are certified as suitable for government and defence use - even when certification is not mandated. Initially the CN9000 encryptors will be FIPS certified (March 2017) and Common Criteria (in progress). NATO certification will also follow. In each of the customer and partner 100Gbps network security solutions, certification is mandated. They are familiar with Senetas certification experience with multiple independent testing authorities and the current in process status, which is publicly verifiable. > End-to-end, authenticated network encryption > Standards based encryption algorithms Secondly, they are independently certified (FIPS and/or CC) as suitable for government and defence use.

9 Encryptors deployed - CN9100 and CN9120 The CN9100 encryptors are essentially the same product but for a single difference network interfaces. The CN9100 variant differs to the CN9120 variant due to the different (transceiver) network interfaces regular local links (WAN) and long haul (MAN) links. The CN9100 uses a standard CFP4 network interface for local links up to 10kms. The CN9120 uses the QSFP28 long haul interface for MAN links up to 80kms. The designed-in support for QSFP28 interface for long-haul MAN distances proved to be an important operational and financial benefit for one customer use case. Because the customer does not need to add OTN devices to its extensive network to enable optimal transmission signal; the benefits to both the customers TCO and ROI are substantial. The partner s global Cloud and data centre services network links required encryption across distances of up to 80km. The QSFP28 interface CN9120 version is ideal for this use case. However, the customer s data centre-to-data centre 100Gbps fibre network only involved local link distances; so, the CFP4 network interface CN9100 meets the requirement. The CN9000 Series certified high-assurance encryptors development is based on the internationally successful Senetas CN Series hardware and encryption platform, currently operating in 35 countries. NETAS Senetas

10 What Cloud, data centre and mega data customers want. High-assurance encryption security without compromise! Sample customer/partner use case mandatory requirements Primary Specifications Senetas CN9100 Senetas CN9120 Customer profile Multi-national commercial enterprise Fortune 500 profile Global Cloud Services provider to government & enterprise customers Network design Local Area Metro Area Transceiver type Interface (up to approx. 10Kms) Interface (approx. 70Kms) Bandwidth 100Gbps 100Gbps Customer Application Security Requirements Network performance requirements Latency Big Data / Mega Data applications Robust, high-assurance network encryption Zero impact on 100Gbps bandwidth Business Case Low latency <4 micro-seconds Global Cloud services and multiple data centre backbone/s. FIPS certified, high-assurance encryption Zero impact on 100Gbps bandwidth applications Business Case Low latency <3 micro-seconds Data overheads Minimal Near-zero Transceiver connectivity Security performance requirements Regular distance transceiver signal Maximum high-assurance components Must enable long haul transceiver signal to avoid network OTN costs Maximum per FIPS certification Certifications N/A FIPS High-assurance attributes Yes Yes Automatic 'zero-touch' key management No adverse impact on 100Gbps network performance High ROI Yes Preferred Efficient TCO Yes Yes 'Real time' applications performance Yes Yes Network architecture / topology - hub & spoke, fully meshed, 'multi-point' Yes Yes Yes Yes Yes Yes

11 CN9000 Series 'high-assurance' 100Gbps 'mega data' encryptors Why Senetas CN9000 encryptors for ultra-fast bandwidth applications? Certified, maximum data protection without compromising ultra-fast 100Gbps network performance: > Robust, high-assurance encryption > Maximum security performance of dedicated secure hardware encryption > Secure data transmission across Layer 2 networks > Excellent total cost of ownership (TCO) and security return on investment (ROI) > Zero latency impact > Zero network impact > Maximum network bandwidth availability and speed performance > Zero data overheads impact > Scalability > Flexibility / Customisation > Ease of management > Maximum availability up time (99.999%) Field Programmable Gate Array (FPGA) benefits: > Solution flexibility > Crypto-agility and Quantum ready enablement > Advanced customisation capabilities > Zero-touch automatic key management > Hardware flexibility not enabled by ASICs Senetas high-assurance Layer 2 Metro Area and Carrier Ethernet network encryptors protect much of the world s most sensitive data and are used in more than 30 countries. CN Gbps 'mega data' encryptor

12 GLOBAL SUPPORT AND DISTRIBUTION Senetas high-assurance encryptors are supported and distributed globally (excl. AUS & NZ) by Gemalto the world s largest data security company - under its SafeNet Identity and Data Protection Solutions brand. Gemalto also provides pre-sales technical support to hundreds of accredited partners around the world; including systems integrators, data network providers, cloud and data centre service providers, telecommunications companies and network security specialists. TALK TO OR OUR PARTNERS Senetas and Gemalto also work with customers own data network service providers, systems integrators and information security specialists to specify the optimal high-assurance encryption solution for their needs. Wherever you are, simply contact Senetas or Gemalto to discuss your needs. Or, if you prefer, your service provider may contact Senetas or Gemalto on your behalf. CERTIFIED HIGH- ASSURANCE NETWORK DATA ENCRYPTION CORPORATION LIMITED E info@senetas.com Senetas manufactures high-assurance Layer 2 Metro Area and Carrier Ethernet network encryptors. They support all Layer 2 protocols and topologies. Our multi-certified encryptors are used by some of the world s most secure organisations; including governments and defence forces, commercial and industrial enterprises, Cloud, data centre and telecommunications service providers in more than 40 countries. Whatever your Layer 2 Ethernet network security needs, Senetas has a high-assurance solution to suit. They support data network links from modest 10Mbps and 100Mbps to high speed 1Gbps and 10Gbps as well as 10 x 10Gbps and ultra-fast 100Gbps bandwidth. Certified, scalable, agile and easy to use; Senetas high-assurance encryptors provide maximum data security without compromising network performance. SafeNet CN Series Ethernet encryptors GEMALTO DISTRIBUTION & SUPPORT High-Assurance Encryption CN Ethernet Encryptors. Senetas CN Series certified high-assurance network encryptors are distributed and supported internationally by Gemalto (North America, Europe, Asia, Middle East and Africa) as SafeNet Author: Simon Galbally CN9KUC-SP0617