ESA UNCLASSIFIED – For Official Use High Speed Network and Security For Copernicus Communities Case Study ESA EOP-G Network & Security Team Francesco Nisi, RHEA System SA TNC-15 - Porto (Portugal), 17/06/2015

ESA UNCLASSIFIED – For Official Use Copernicus Programme In-Situ Compone nt Services Compone nt Copernicus (formerly known as GMES) is a European space flagship programme led by the European Union Provides the necessary data for operational monitoring of the environment and for civil security, generated (several TB/day) by a fleet of satellites called Sentinels equipped with new generation instruments Users shall have free, full and open access to Copernicus dedicated Sentinel data and Copernicus service information ESA coordinates the Space Component Space Component

ESA UNCLASSIFIED – For Official Use Copernicus Ground Segment Circulation and Dissemination Network Circulation Network Dissemination Network “Internet” Other services Mirror Sites General Public Firewall & CPE Tailored access for specific user communities

ESA UNCLASSIFIED – For Official Use Copernicus Network & Security Services Procurement and Deployment milestones The Network & Security services implements the Circulation and Dissemination networks Open Tender according to ESA procurement regulations - issued on June 2012 Contract awarded to a commercial provider and kicked-off in February 2013 The five Sentinel-1 facilities ready in pre-operation in September 2013 Nominal operations started on December : Network completed with S2 and S3 facilities, Central Dissemination facility The Challenges Provide high speed (10G) WAN network between facilities located Mainland Europe and with the remote receiving stations; Provide a high capacity (10G+) and scalable solution to disseminate huge amount of data to user communities Ensure Security and open the network to multiple communities at the same time

ESA UNCLASSIFIED – For Official Use Copernicus Ground Segment 3 Core Ground Stations 5 Processing & Archiving Centres Mission Performance Centres PDMC Centres Marine Centre EDRS Receiving Station (2015) Virtual Archives & Processing Distributed over 11+ Facilities

ESA UNCLASSIFIED – For Official Use Agenda Copernicus Ground Segment The Copernicus WAN Solution Service Model Verification & Validation Conclusions The Copernicus WAN Solution

ESA UNCLASSIFIED – For Official Use The Network & Security Services Centralised services design for easier management and control Central Service Area in two Twin Core Data Center Hosts the Copernicus central services: Internet Access, Auxiliary Services (DNS, NTP, Proxy, Mail Relay), RAS and Pick-Up Point (storage and data dissemination) Local Services: Firewall/IDPS + Local LAN Connected via the Intranet Service

ESA UNCLASSIFIED – For Official Use WAN Intranet Service The DWDM Backbone 10G DWDM Backbone IP/MPLS connectivity 3 VRFs Both links active and carrying traffic in nominal conditions 9K MTU end-to-end

ESA UNCLASSIFIED – For Official Use Internet Access Service Redundant 10 Gbps connection to DTAG Backbone Autonomous System 3320 with peering agreements on a global scale Scalable by adding additional 10 G links Security enforcement Connected with GEANT via third AS with multiple connections Serves Core Users community accessing the local DMZs Dedicated GEANT connectivity via DFN (planned)

ESA UNCLASSIFIED – For Official Use Pick-Up Point Service A Central Virtual Archive Service Storage area connected at 10 Gbps to the Internet backbone Rolling archive for 12 months of Sentinels products Ready for 10+ Petabyte of storage (3 PB by 2015) Maximum performance thanks to reduced network latency Based on virtualised infrastructure Available for scientific community and general public Connectivity to academic user community via GEANT (planned)

ESA UNCLASSIFIED – For Official Use Security Services The Defence Perimeter DDOS Ctrl FWs +IDPS Ctrl Services Loc. FW+IDPS End Systems Redundant central firewalls to enforce the EU/ESA security policies Redundant DDoS self-learning detection and mitigation IDS/IPS detection and blocking Central events correlation service Redundant Proxies Peripheral firewalls with local IPS/IDS ACLs and Iptables SIEM solution

ESA UNCLASSIFIED – For Official Use Security Services Security Policy Enforcement ESA Earth Observation Security Policy Enforcement Only authorized and documented Data Flows are traversing the local and central Firewall PDGS Systems published on Internet only after successful Security Plan process Proxy and Mail-Relay accessible by authenticated clients Proxy URL Filtering based on white list allowing only business related destinations Continuous process for monitoring and fine tuning of the DDoS, IDPS and Firewalls configuration Continuous update and patching process

ESA UNCLASSIFIED – For Official Use Agenda Introduction The Copernicus WAN Solution Verification & Validation Conclusions Service Model

ESA UNCLASSIFIED – For Official Use Service Model Service Level Agreement Service coverage for all the services: 24/7 Target availability for the connectivity services: 99.95% Maximum Time To Repair for blocking/critical incidents: 4/8 hours Change implementation time: 8 hours Penalty scheme associated to each service level target One provider for all the Services Single contact point for all the services available 24/7 Network Operations Center (NOC) Security Operations Center (SOC)

ESA UNCLASSIFIED – For Official Use Agenda Introduction The Copernicus WAN Solution Service Model Network Operations Conclusions Verification & Validation

ESA UNCLASSIFIED – For Official Use Verification & Validation Approach V&V Approach LAB Test for Design validation Verification of each service element during the deployment phase Validation during the Service Acceptance Testing Areas Functional test to verify the configuration of each element and integration in the monitoring & control tools and other PDGS elements Performance tests: Line capacity and line quality (packet loss, jitter, latency); TCP Throughputs; Auxiliary services performance baseline (e.g.: DNS, NTP, Proxy) Redundancy: Extensive test campaign performed to verify the redundancy and failover behaviour of each solution element Security: Penetration and DDoS test (external specialised company)

ESA UNCLASSIFIED – For Official Use Intranet Service (1/2) Test Results Highlights Tools based on IXIA technology with multiple 10Gbps TCP/UDP traffic generators Lines are clean and enable applications/OS to use large TCP window RTDs in line with expected values due to the distances. Some room for improvements. Failover behaviour as by design

ESA UNCLASSIFIED – For Official Use Intranet Service (2/2) Test Results Highlights Findings: The file size has a big impact of the throughput Noticeable improvement derived from TCP configuration parameters fine tuning. Some TCP parameters(i.e.: congestion avoidance algorithm) are effective only to specific scenarios -> customization per project is necessary File size Buffer size = 16 MB TCP congestion avoidance algorithm Buffer size = 2 MB TCP congestion avoidance algorithm Cubic (KB/s) HTCP (KB/s) Hybla (KB/s) Cubic (KB/s) HTCP (KB/s) Hybla (KB/s) 20 MB MB MB GB

ESA UNCLASSIFIED – For Official Use Internet Service Test Results Highlights (will be expanded) User AS Path RTD [ms] IPerf tests [Mbps] FTP Downloads [Mbps] Remark University of Tokyo, Japan AS2501/AS2907/ AS701/AS University of Leeds, UK AS786/AS1299/ AS Not conducted Using FTP Using WGET STFC Chilton, UK AS786/AS1299/ AS Average values Peak value University of Miami, USA AS451/AS209 /AS Not conducted IREA-CNR Naples, Italy AS137/AS3356/ AS Local WAN limit of 100 Mbit/s Test campaign to assess the achievable performance via commercial Internet for different user communities Good performance with peaks up to nearly 900 Mbps for European users with 45 ms RTD, and TCP stack and servers optimization and high speed local Internet access Performance strongly depends on the remote user systems fine tuning and application used for the download

ESA UNCLASSIFIED – For Official Use Agenda Introduction The Copernicus WAN Solution Service Model Verification & Validation Conclusions

ESA UNCLASSIFIED – For Official Use Conclusions Utilization of DWDM technologies to build a 10G capable network backbone between Copernicus sites ensure the needed network capacity and stability Performance tests confirm the importance of the end systems fine tuning to get the highest achievable performance. The current Internet access based on multiple 10G nodes via commercial provider ensures the needed capacity for data dissemination to the general public and all scientific communities WHAT NEXT: Increase the dissemination capabilities in order to serve the additional user communities that will access to the new Sentinels data portals Deploy a dedicated 10 Gbps connection between Copernicus and GEANT networks to improve the access capacity for scientific communities connected to the academic networks Build and integrate a performance monitoring solution

ESA UNCLASSIFIED – For Official Use Important Dates: Deadline for abstract submission16 October 2015 Notification of AcceptancesEnd January 2016 Issue of Preliminary ProgrammeFebruary 2016 Opening of Registration to the SymposiumFebruary 2016 Release of the Final Programme at the symposium Submission of Full Papers at the symposium Themes: Atmosphere, Oceanography, Cryosphere, Land, Hazards, Climate and Meteorology, Solid Earth/Geodesy, Near-Earth Environment, Methodologies and Products, Open Science PRAGUE MAY 2016 Main Objective: Presentation of Exploitation Results based on ESA Earth Observation Measurements