Distrix_Software_Defined_Infrastructure_White_Paper
- 1. 1© 2016 Distrix Networks Ltd. All Right Reserved A Distrix Networks White Paper January 7, 2016 Distrix Software Defined Infrastructure Making complex networks manageable
- 2. 2 © 2016 Distrix Networks Ltd. All Right Reserved Introduction Distrix approaches networking by layering an advanced Software Defined Infrastructure (SDI) on top of existing equipment and networks. Distrix applies management, routing, rules, redundancy and security to data at any layer – from the physical port through the transport layer all the way to the application layer – making it the most flexible and adaptable solution for Industrial Internet connectivity. This flexibility brings exceptional power and control to hybrid industrial IT/OT networks that typically include UDP/IP/Serial communications across a variety of transport methods, and with the ability to tag data streams with derived metadata, Distrix can increase the performance of existing networks and better utilize resources flexibly and dynamically. The Distrix solution runs on commonly used OT or IT systems, and has the flexibility and low footprint requirements to enable it to embed responsive logic and control right into the network itself – without the additional expense of wholesale network replacement, and with the advantage of staged deployments and advanced interoperability.
- 3. 3 The Power of the Distrix Gateway The Distrix Gateway provides the network and application separation needed for optimal Industrial Internet Network design. Distrix Tunnels focus on the needs of the applications, while Distrix Link Modules manage the underlying infrastructure, and the Distrix Core provides the ability to put the two together and provide optimal application performance with a dynamic and resilient Software Defined Infrastructure. The result is IT and OT applications acting and reacting independently or in concert, as business rules dictate. Supported Platforms x86/x64 Windows 7 Ubuntu Linux Raspberry Pi 2 Raspbian Jessie x64 Red Hat/CentOS Linux ARM9 Very flexible; please contact Distrix Sales to discuss your needs. Distrix Gateways are installed on existing networking and control equipment to provide a common interface through Distrix Link Modules to leverage the power of advanced Software Defined Networking across IT and OT systems and equipment. The Distrix Gateway establishes Distrix Tunnels to transmit data easily and efficiently, regardless of actual physical infrastructure
- 4. 4 © 2016 Distrix Networks Ltd. All Right Reserved Overview with Distrix Core The Distrix Core, a key component of the Distrix Gateway, creates and manages the Distrix SDI using a unique distributed intelligence network model, enabling individual nodes to host functions that are usually centrally controlled. This distributed approach boasts far greater power and flexibility than centralized systems. Action is taken where the data itself is traversing the network, with no need to adjust or even configure physical infrastructure. This capability extends from filtering and contextualized logic to dynamic and reactive logical routing. With gateways exchanging path information, the Core monitors and selects which gateways in the network constitute the optimal route to the destination for a particular Tunnel Stream regardless of the physical infrastructure. The power of the Core is also extensible, with a modular plugin architecture connecting the Core to physical infrastructure or applications - separating peripheral functions of Distrix and providing flexibility in implementations. This architecture includes open APIs for the creation of customized plugins to meet customers’ specific needs. Tying all this together with a REST API allows for external applications to take direct advantage of the Software Defined Infrastructure to manage, scale, and monitor the individual nodes or the important data traffic that is critical to the business. Applications can effectively configure or reconfigure the network and add new services dynamically without the need for rigorous network design.
- 5. 5 Feature Details Traffic Routing Gateways read tagged data streams and relate that to the originating and receiving nodes in order to route traffic based on changing conditions Endpoint Identification The flexibility of a Distrix network means that the Distrix Core and Prioritization can identify and prioritize end points for data on the fly – an originating node may have a variety of potential endpoints; the Distrix Core on each node helps to define the most appropriate one based on current conditions. Optimization By constantly monitoring their piece of the network in relation to the capabilities of different linkages and the needs of the data itself as defined by its meta-data, the Distrix Core acts as a distributed optimization center. Management Distrix Core is able to give IT and OT managers significant and timely insight to network health and utilization through analytics that would not otherwise be available with a centrally monitored or fragmented system.
- 6. 6 © 2016 Distrix Networks Ltd. All Right Reserved Advanced and Responsive Software Defined Infrastructure With Distrix Link Modules Distrix Link modules interface with the underlying physical network while creating the software overlay infrastructure, adding flexibility, redundancy and security to the entire system. Distrix Link Modules build connections between Distrix Gateways and provide detailed network metrics to the Distrix Core on the links formed across the network,enabling the system to determine what interfaces are optimal for a particular data stream, considering bandwidth, latency, cost of use, and other factors. The result is a dynamic network that resolves connectivity based on changing conditions, and reacts instantly by re-routing and assigning higher priority to data streams that deserve it with no disruption to other data flows. The network is stabilized and optimized, and the operator receives constant and verified contextualized knowledge of the network’s performance and the state of its components.
- 7. 7 USE CASES Video traffic starts transmitting on a security perimeter breach and results in non- critical data being suspended while the video traffic is routed a 3G connection. A broken fiber links renders connectivity to a actuator limited but this critical data can be routed over a secondary WiFi link. Changing bandwidth availability on a satellite uplink causes critical data to take priority and non-critical data to be cached or transmitted through higher latency channels. Type Features and Advantages UDP The UDP Link Module is the recommended Link Module for use across IP networks. It provides Distrix with the greatest flexibility for link and stream management including the use of both reliable and unreliable Tunnel Streams. UDP links can be defined in a way that specifies the connection to and from specific interfaces on both Windows and Linux. This allows the designated use of multiple interfaces on devices for seamless link transition and aggregated bandwidth. UDP link module overhead is minimal. Resultant latency of stream overhead across Distrix links is typically in a single digit microsecond range, and bandwidth impact is limited to the addition of a small Distrix header. The UDP Link Module can be configured to listen on one or more ports for other Distrix Gateway connections. To help prevent denial of service attacks, the UDP link module can be configured to require acceptance of a cookie by the targeting gateway. Serial The Distrix Serial Link Module can be used to connect two Distrix Gateways to each other using crossover serial connections. More commonly, serial will be used to connect Distrix to a serial communications device, such as commonly used spectrum hopping radio or satellite gateways. In these cases, Distrix will set up a connection as DTE rather than DCE. Serial properties are configurable and can use hardware flow control if appropriate. TCP Some networks and firewalls block UDP traffic on all ports. In these cases, the TCP Link Module can be used as an alternative means of forming links between Distrix Gateways over IP networks. Because TCP is an inherently reliable connection, some additional traffic overhead can be expected.
- 8. 8 © 2016 Distrix Networks Ltd. All Right Reserved Targeted Data Streams With Distrix Tunnels Distrix communication channels, called Distrix Tunnels, form secure tagged data streams, and accommodate multiple origins, destinations, and channels while responding to constantly changing network conditions. Encryption adds further Tunnel capabilities by securing communications either from one gateway to another, or by network class for even finer grained control. Because the intelligence of the network is resident within Distrix Gateways, end points define the destination of their payload, not the route to be taken. This inherent design provides the most flexible network design possible. By tagging the data stream as part of the encryption and encapsulation process, Distrix Tunnels are able to cross reference relevant network and application states and needs in order to pick the most appropriate path for that particular data stream. The power of Distrix Tunnel communications is enhanced further with its ability to be defined at any of several layers - from the port, up to the application. This can be leveraged to improve network performance and capabilities as well. For example, Distrix may provide QoS where an application does not normally allow it; it may compensate for lost packets, and packet size and wait times may be adjusted to either improve performance or reduce overall traffic. With Distrix Tunnels data can be filtered based on upper and lower threshold values, frequency of data transmission, or other characteristics – and appropriate action can be taken. For example, a data feed from a temperature monitor may not be high priority traffic, unless it exceeds a certain value, or unless it is triggered with a certain frequency. In addition, with data manipulation capabilities, Distrix Tunnels can provide on the fly translations to provide greater integration between systems, such as converting hex values from a PLC to decimal or binary as needed by a database server.
- 9. 9 Type Method Details Digital Connection at input and Read/write is initiated from the pins using OS drivers. Interrupt and output pins of general polling mode supported. Polling interval configurable in microseconds, purpose IO port with automatic monitoring to send data data only on change of a pin value. Ethernet Encapsulation of Tunnel behaves as a pseudo-wire connection with routing capabilities. Ethernet frames Linux tap and bridge utilities provide direct access to Ethernet packets to and from the physical interface. Tunnel endpoints are configured as a switch by default to connect multiple gateways and share data from each interface among several identified endpoints. HTTP/S Point to Point Proxy Addresses and ports accessing network resources hosted at origin are proxied to a bind address at the destination. SSL/TLS supported. Connections can be pipelined to improve connection performance to commonly used resources. Splunk Point to Point The Distrix TCP tunnel module can be used to write various data types directly to a Splunk Indexer by identifying a TCP listen port on the Splunk indexer, and writing to that port using the Distrix TCP tunnel. By implementing Hybrid Tunnels, a number of datatypes are easily collected from the network edge and written securely to Splunk. Hybrid tunnels that can be configured without any data conversion requirements include the GPIO, Serial, TCP, and Modbus tunnels. Serial RS-232 and RS-422/485 Standard serial configuration parameters (i.e. flow control and baud rate), or tuned to serial device and infrastructure properties. IP IPv4 and IPv6 Devices on each local network are configured to use the Distrix as the gateway for the connected networks, or to have a local default gateway route traffic for the remote network through the Distrix gateway. NAT translation, remapping, and DNS support provided. Fine grained client / server specificity controls the ability to create connections Modbus Modbus RTU or TCP Both Modbus RTU (RS-485 or RS-232) and Modbus TCP are supported by the Modbus Tunnel Module in both Master and Slave mode. The configuration allows definition of the coils and registered to be written to or polled. As a Master or Client, the frequency at which to communicate with the Slave or Server can be configured. Data is communicated in simple textual format. In Hybrid mode, data conversions can be easily applied through policies. Application Application socket The application tunnel module is a library that links into the user’s program and writes to an application socket. It can be used to either integrate a secure remote connection into an existing application, or embed Distrix capabilities into an application to simplify the implementation of the network stack. The application tunnel can also be used in application to application or in hybrid modes. Hybrid mode simplifies the integration of sensor and system data to database or monitoring applications.
- 10. 10 © 2016 Distrix Networks Ltd. All Right Reserved Increasing the Power of Existing Networks With the Distrix Software Defined Infrastructure overlaying a virtual network through Distrix Gateways, the ability to manipulate and manage data in the network itself opens up tremendous possibilities for increased efficiency, insight, and contextualized action through payload and communications header analysis and modification. A number of policies are included for common functions, and custom policies can be easily generated for additional functionality. In many OT networks, sensor data is collected from operational systems and provides little or no information other than a measured value. In order to analyze the data in a wider operational context, additional information is very helpful. With Distrix, timestamp, location and other configuration management information can be added to the data stream for a much clearer view of the operation’s overall Industrial Internet. Data collected from devices such as PLCs are often hexadecimal representations of values collected by the local system. With Distrix, calculations or data conversions can be applied to raw data values at the source, to provide user readable data to an analytical system, opening the door for very advanced visualizations and automation, as well as data translation for system integration. Distrix provides the ability for overall data communication to be reduced by filtering less valuable data, which might be defined by setpoints, frequency, or other measures. Data filtering is often used in conjunction with other modifications in the data stream to simultaneously reduce data volume increase data value, for greater efficiency and reduced complexity of the network itself. With Distrix, several inputs can be used to manage various aspects of network performance. Response times from network resources can be leveraged to determine endpoint preference and complex rules can be developed to manage the network automatically and dynamically under changing conditions. With Distrix Policy Modules Metadata addition Data manipulation Data filtering Dynamic routing
- 11. 11 Since the full functionality of the Distrix software has a footprint of under 50MB, it can be added to many legacy and new OT and IT endpoints, such as motor controllers, PLCs and Smart Grid meters. Whatever the device, Distrix Links encapsulates, encrypts, and hides data at the packet level, meaning data is protected in transit, regardless of whether it travels across the internet, over radio transmission, or in the clear. Packet Level Encryption of Device Data Advanced Security Capabilities Distrix software was originally designed and deployed for the US Predator Drone program, where highly stealth, secure and reliable communications are mission critical requirements. The capabilities born out of the Drone program and other secure government operations are available to customers of the Distrix solution. In a world where experts advise companies to create a security posture under the assumption that attackers may already be operating inside their network, Distrix provides a secure OT/IT end to end solution even if a portion of the existing network is compromised. Distrix provides multiple layers of encryption, securing data at the packet level via Distrix Links as well as end to end through Distrix Tunnels. Distrix Links encapsulate and encrypt packet data between network nodes. Distrix Tunnels provide end to end application layer encryption and security as well as user authentication and role based access. A unique Distrix Tunnel is established for each individual data endpoint. Each Distrix Tunnel is encrypted independently with its own unique key that can only be accessed at the data source and end destination, so the data is protected end to end until it reaches the terminating Distrix node. In the unlikely event that one Tunnel is compromised, the other Distrix Tunnels remain secure with their own unique keys. Unique Encryption per Distrix Tunnel
- 12. 12 © 2016 Distrix Networks Ltd. All Right Reserved Advanced Security Capabilities Continued Since Distrix is able to select any layer of the OSI model for data transmission, sensitive data does not have to be delivered through the traditional Physical connections, Data links or Application layers that hackers and other adversaries may be watching. Data can be sent over any channel, whether or not it was intended for that application or protocol. These covert communication channels can be dynamically changed based on policy, if desired. Data packets that are encapsulated at the source (per the process above) can then be randomly transmitted across a variety of links, ports and protocols. Modbus TCP traffic, for example, does not have to be transmitted via Port 502, but can be encapsulated and delivered randomly via UDP streams via port 5060, SNMP traffic via Port 161, etc, and then reassembled at the destination endpoint. The packets remain in their original protocol, they are simply encapsulated and disguised as a different protocol and transmitted across different channels. This stealth capability adds a layer of security so that data is safely and covertly communicated even if systems are compromised and being sniffed by hackers. Distrix allows customers to use their own encryption at any point in the transmission, adding even more layers of protection. Customers can combine any or all of the above encryption and covert communications techniques for multiple layers of security. With this approach, adversaries would need to successfully penetrate every layer in order to retrieve sensitive customer data. Even if hackers had successfully breached a portion of the customer’s existing network prior to the Distrix solution implementation, Distrix is able to encapsulate data at the packet level at the source as well as provide an encrypted end to end Distrix Tunnel within that customer network and across the internet, so data remains protected even in the most hostile environments. Distrix also provides extensible management tools for additional security, such as: Rich authentication and authorization Handshake validation for network infrastructure connections Covert Communication Channels Multi-layered End to End Security Additional Security Management Tools Grouping for network management User Class assignment
- 13. 13 Complete Control With Distrix Management SELECTED REPORTING ELEMENTS Successful Industrial Internet deployments require control and insight, and Distrix provides the functionality as well as the extensibility to leverage other dedicated platforms as needed. The Distrix API enables comprehensive network monitoring and management. Instantaneous feedback of the states of each layer of both the Distrix network and the underlying physical infrastructure keep operators and other users informed. A basic GUI is provided with the Distrix platform for core functionality, which may be further expanded by integration with dedicated IT and OT monitoring platforms. Distrix Links Performance characteristics - Bandwidth - Latency - Jitter Utilization - Bandwidth Used - Data volumes transmitted and received Queued data The Distrix Gateway CPU utilization Licensing status Distrix Tunnels Bandwidth of streams by direction Tunnel addressing Host and requestor addressing Control Gateway license management User authentication and privilege delegation Network security management Network infrastructure configuration Creation and configuration of link targets Tunnel endpoint configuration
- 14. 14 © 2016 Distrix Networks Ltd. All Right Reserved About Distrix Distrix unlocks the benefits of advanced, integrated enterprise and operational systems to increase security, competitiveness and asset utilization while reducing costs and risks. Distrix Application Specific Software Defined Networking is the ideal platform to leverage the advantages of the Industrial Internet of Things. Distrix solutions do not require wholesale network equipment replacement, they are easily staged for minimal business disruption, and they are easily integrated with a remarkably small footprint – helping ensure asset longevity and upgradeability. 1880 West 1st Ave, Suite 200 Vancouver, BC V6J 1G5 Canada 1-855-657-7275 info@Distrix.com http://www.Distrix.com To contact our offices: