DSS ITSEC. October 22, 2015. Riga, Latvia. Alexander Lyamin. Head of network division. CEO, owner Qrator Labs

1. DDoS mitigation for systems processing
confidentional information

2. Money Personal
data
Commercial
data
NOT ONLY!
Confidentional information
qrator.net 2015

3. Universal SSL
SSL traffic growth
Exabytes
p.a.
Sandvine GIRP projection
Data courtesy of Sandvine Global Internet Phenomena Report - 2H 2012
2012
0
5 000
10 000
15 000
20 000
25 000
30 000
35 000
40 000
45 000
2013 2014 2015 2016 2017 2018
Coyote Point Projection
qrator.net 2015

4. SSL enabled by default
use SSL
as the default protocol
qrator.net 2015

5. What about DDoS?
DDoS type by target Botnet size
Network infrastructure 10K+
Protocol stack 1K+
Application 100+
Exceeding bandwidth capacity 100K+
qrator.net 2015

6. Sensible, semantically complete applicaiton-layer constructs
Application-layer attacks
qrator.net 2015

7. Challenge
?
?
?
SSL
Encryption
qrator.net 2015

8. Industry solutions
Encryption key
disclosure
Сloudflare
KeylessSSL
(2014)
Qrator QLOG
(2012)
qrator.net 2015

9. Client random
Server random
Public key certificate
Visitor
Server DH parameter
Client DH parameter
Premaster secret
Session key
Signature from key
server
CloudFlare
Key server
Origin server
Cashed content
Uncashed content
Private key
Keyless SSL
Client random
Server random
Public key certificate
Server DH parameter
Client DH parameter
Premaster secret
Session key
Signature from key
server
1
5
2а
4
2b
3
qrator.net 2015

10. User
HTTP
Operator network
perimeter
Orator filtering
node
Client http
server
Client network
Client network
API
Access log
Solution by Qrator
qrator.net 2015

11. Qrator API
100.000+ IPs
in black/white lists
Real-time access
and management
Policies Real-time
statistics
Expanding functionality -S
all features are avaliable
through API
qrator.net 2015

12. QLOG
qrator.net 2015
Verbose control
and moderation
of disclosed data.
Log formats are
discussable
Easy to configure --
a single IPIP tunnel
Fault tolerance

13. One-to-many
Fault tolerance
Qrator
network
Filtering
node
user
user
zombiezombie
As Qrator
178.248.232.0/21
As Qrator
178.248.232.0/21
client’s IP
Filtering
node
user
zombie
client app
user
user
zombieuser
user
qrator.net 2015

14. Variety of combinations
All of this can be applied an any combimation with any priority
Qrator API
(White | Black lists)
Qrator API
(Default DROP |
ACCEPT policy)
Qrator classificator
(Advisory|Director)
qrator.net 2015

15. One last thing
For payment systems using a third-party
merchandiser: we offer to embed our
proprietary authentication algorithm into
the client application source code,
providing additional verification of users’
IP addresses in case of a DDoS attack
Have a word with me later or reach me by
email!
It’s too sophisticated and mind-blowing
for a single picture - better to save it for a
separate presentation
It guarantees that all transactions in the
payment system will proceed even during
the attack
qrator.net 2015

16. Thanks for your attention!
QRATORLABS qrator.net
al@qrator.net