The enforcer

Speed with security may not be an oxymoron, but for service providers moving to next generation networking, it's close.

iPolicy Networks, a Fremont, Calif.-based start-up, has created and brought to market an integrated network security platform that aims to make speed and security go together like “economic” and “downturn.”

iPolicy's platform features a multigigabit intrusion detection capability, which the company claims is an industry first. It combines a firewall solution from Elron Software, anti-virus software from McAfee and intrusion detection capabilities from Symantec onto a single platform.

The two primary components of the iPolicy platform are the ipEnforcer 5000 and the ipEnforcer Unified Service Manager. Together they use iPolicy's Light Speed 1 packet inspection engine to support up to five service applications running simultaneously on either Solaris or Windows NT-based systems. These applications include intrusion detection, firewall, bandwidth management and application transaction prioritization.

“The functions are broken up to run on multiple processors simultaneously because if we were running just one of these processors, we'd never be able to deliver multigigabit speeds,” said Mark Housman, vice president of marketing for iPolicy.

The system protects against threats such as distributed denial of service attacks, viruses that come from e-mail and intrusions from hackers who try to overrun a service provider's site.

“Security is a not a like-to-have, it's a got-to-have,” Housman said.

TMEX USA, an international telecom company, and VPN Dynamics, a managed security solutions provider, are currently testing iPolicy's solution. Beta tests also will take place soon with an undisclosed Tier 1 service provider and a Tier 1 data center, Housman said. General availability is expected in early September.

TMEX USA decided to test the iPolicy system because its hardware architecture has the capacity to add additional functionality and feature sets, said Executive Director Cooper Lee. “We're able to benefit from wire-speed transmission instead of some kind of bottleneck with memory and queues and buffers that can overflow,” he said. “Right now the only downfall is it doesn't support a stand-alone configuration. It requires an Oracle database server.”

But using an Oracle-based system is less of an issue in a full-scale deployment, iPolicy's Housman said. “The need to run an Oracle database might be a minor issue only if the service provider were deploying a single ipEnforcer 5000, which would not be the norm,” he said.

The Unified Service Manager is a customer management system that can manage up to 100,000 customers across a wide geographic area with discrete policies without focusing on which ipEnforcer 5000 they're connected to, Housman added.

TMEX plans to deploy the ipEnforcer 5000 at each of its gateway nodes and across its Internet backbone and access network, Lee said.

iPolicy's approach of integrating security applications could help businesses concerned with protecting operations and business data, said Tere Bracco, director of e-business infrastructure for Current Analysis.

“Platforms like ipEnforcer provide service providers [what] they need to offer managed security easily [and] quickly with minimal affect on network performance,” she said.

Bracco does have one issue with the platform. “I have yet to receive much information about the management of the box,” she said. “Other than that, it's a sound concept and good business proposition.”