Skip to main content

General Concepts

Mitigation Components​

RioRey uses several components to handle DDoS mitigation:

  • RIOS- Filter devices that sit inline to automatically detect and drop attack traffic.
  • rWeb- A management system which is used to manage and coordinate RIOS filtering behavior and Director monitoring.
  • Director- A flow monitoring platform that can perform traffic redirection or other actions in response to network events.
  • rCloud- RioRey's scrubbing service, which deploys RIOS and rWeb in the cloud for additional mitigation capacity on demand.

RIOS​

RIOS devices act as a "smart wire", where all traffic on their upstream ports are analyzed for attacks, but traffic is passed through exactly as it is sent. MAC and IP addresses are preserved, and no network topology changes are required to deploy RIOS. When the traffic behavior is determined to be part of an attack, it is simply dropped in place and not forwarded to the downstream port.

When a RIOS device is placed in path like this, it transparently passes through any control traffic related to port aggregation, like Link Aggregation Control Protocol (LACP) to the devices on either side. These devices should be configured to talk to each other as normal, as if the RIOS device was not sitting between them.

info

When using LACP, it should be set up so that each port receives flow consistent traffic. Otherwise, you may observe false positives.

Similarly, RIOS will transparently unwrap and examine the innermost data packet, irrespective of any L2 or L3 modifications to a packet such as Virtual Local Area Network (VLAN) tags or Multiprotocol Label Switching (MPLS). General data tunneling using Generic Routing Encapsulation (GRE) will also be unwrapped and filtered based on the innermost layer (i.e. the final destination of the packet).

info

Traffic is always unwrapped in RIOS versions prior to 8.7.0. Starting in 8.7.0, devices can be configured to not unwrap traffic and instead handle it based on the outermost visible IP header.

Traffic over encrypted channels, like most Virtual Private Network (VPN) implementations, cannot be examined. In the case of VPNs, RIOS makes filtering decisions based on the outermost visible public network layer.

RIOS devices only need to analyze traffic behavior in the WAN (upstream) to LAN (downstream) direction in order to detect attack traffic. Traffic in the reverse direction is always forwarded automatically, and can even be sent through another route entirely (not through RIOS). Thus, asymmetric routing with RIOS is supported.

Our algorithms perform real-time packet behavior analysis, so we can determine whether or not a given packet is misbehaving within seconds. Unlike traditional filtering approaches that use packet matching profiles, which can be restrictive and limited, our algorithmic approach uses analytical methods to dynamically discriminate between good and attack traffic on a packet by packet basis.

By examining packet behavior at the protocol level rather than specific data content, we can handle encrypted data without the need for decryption. This approach does not use network statistics (such as sFlow or Netflow), so attack traffic or clean traffic can be identified without requiring operator intervention or impacting good traffic. Moreover, this approach does not require baselining of normal traffic or signature updates to detect attack traffic. This also allows us to handle zero-day attacks without any additional configuration.

rWeb​

rWeb provides a multi-tenant web-based Graphical User Interface (GUI) to manage the configuration of one or more RIOS devices and receive reporting about both clean and attack traffic. Attack behavior is determined according to the 25 different attack algorithms. For resiliency, RIOS and Director devices continue to use their last set of configuration received when they are unable to communicate with rWeb.

rWeb's GUI is built on top of a feature rich API that can be used to integrate RioRey's mitigation filtering and reporting with your own network visibility systems.

Director​

Director performs out-of-band flow analysis (using standard sampling protocols such as NetFlow, IPFIX, and sFlow) to determine current traffic conditions using flow samples and mitigate attacks through redirection or other traffic engineering policies. Director leverages network and customer definitions (Groups and Zones) from rWeb to minimize the amount of effort needed to maintain consistent network routing and mitigation behavior.

rCloud​

rCloud is RioRey's cloud scrubbing service, which utilizes RIOS for filtering traffic while offering rWeb for mitigitation configuration and detailed traffic reporting. Users who already deploy RioRey on-premises will have access to the same toolset they are accustomed to using, with the additional capacity of a cloud offering. Users without RioRey devices can redirect their traffic to rCloud and benefit from the rich reporting and fine-grained control over how their traffic is filtered.

Deployment Models​

RioRey systems can support a number of DDoS mitigation deployment scenarios. Our flexible model allows either a totally on-premises solution, a totally cloud-based solution, or a mixture of both, based on your network capacity and needs.

  • On-Premises Inline- This deployment is best for networks that have a small number of transit links that can be individually protected by RIOS filter devices. In this scenario, a RIOS device is sitting directly inline and observing all traffic from your upstream providers.
  • On-Premises Offramp- This deployment assumes there is a much larger number of incoming traffic links. In order to leverage a smaller number of RIOS filter devices, traffic is monitored from out-of-band using Director. Attacks within mitigation capacity can be redirected internally for filtering, while larger attacks can either be blackholed or filtered more precisely with BGP FlowSpec.
  • Hybrid On-Premise with rCloud- This deployment is the best of both worlds. Attacks are filtered inline as much as possible, but if a given transit interface is oversaturated that traffic can be sent to rCloud, leveraging its additional capacity to handle the attack.