Speakers
Description
At PlayStation, we see DDoS attacks of multiple terabits per second targeting game servers. Traditional DDoS mitigation systems can be costly, slow to react, and difficult to place close enough to the ingress points of the network.
This talk presents a token-based eBPF/XDP architecture for inline DDoS protection. We show how distributing short lived tokens to legitimate clients allows us to make the most of XDP’s position early in the stack for whitelisting and minimise wasted cycles on unwanted traffic. We also complement the overall architecture with an eBPF based agent on the K8s workers that i) removes the need to expose backend clusters directly to the Internet ii) forms a transparent overlay between the public-facing DDoS protection layer and private game-server clouds and iii) solves challenges in integrating with Kubernetes CNIs and cloud environments. In order to tackle the unique requirements of frequently changing routing state that needs to be globally distributed, we also propose a control plane architecture built on CNCF xDS that allows us to propagate tokens at high rates close to our network ingress points, constantly updating the eBPF maps that drive our routing decisions.
Finally, we share lessons from building and operating an eBPF based DDoS protection architecture at global scale. We discuss the challenges of integration with cloud providers and their CNIs, as well as return path optimisations that make the most of Playstation’s backbone network.