Computer Networking 10 page research paper - APA style

module_reading.docx

Home >Computer Science homework help >Computer Networking 10 page research paper - APA style

Module 1: Computer Networks and Networks of Networks

1. Introduction

The date: Sometime in the 1960s. Rockets have recently been used to put the first satellites in orbit. Commercial jets are speeding along at higher and higher speeds, approaching the supersonic. Television is changing from black-and-white and shades of gray to color. These and other technologies are working together to make the world seem smaller and smaller.

The place: Deep in a sub-basement of the Pentagon or some equally obscure government location. You are a member of an arcane, almost clandestine government agency.

Congratulations, Mr. Phelps. You have been selected to lead a team of experts and, with your IMF team, have been selected to provide the world with an infrastructure for sharing data. Your mission, if you choose to accept it, will be to support commercial transactions, video, voice, music, and all other forms of person-to-person and organizational communication. You will need to study means and methods of transferring data that will make data in all forms universally available independent of the workstation and the computer platform as chosen by the user. These workstations will, after the turn of the millennium, number in multiple millions and pervade all social levels. Even children will have access to the workstations through schools, libraries, and at home.

Your success in this assignment will facilitate commerce, improve quality of life for many individuals, and result in major changes in how corporations, schools, governments, and individuals conduct their day-to-day business. Proper decisions in the conduct of this mission will result in all of this happening at low cost and currently inconceivably high rates of speed.

As always, should you fail in your mission, the Secretary will disavow all knowledge of your existence. This tape will self-destruct in 10 seconds.

In hindsight, this could have been the message delivered to a group of mathematicians and communications and electrical engineers in the early 1960s (computer scientists were rare and usually didn't identify themselves as such yet) who worked together to develop what became the Internet. Surely, though, none of those involved thought such results were what would accrue.

Our task this semester is to try to understand how this sharing infrastructure works and how to use it. We start, in this module, with some general concepts and describe tools and techniques. Let's begin.

2. Basic Concepts: A Note about Models

In the domain of computing, models (called variously architectures, logical structures, and conceptual maps) play important roles. The domain of computing is nearly pure ideation. Computer scientists, programmers, and many other IT professionals rely on models to communicate their ideas and creations to others.

The realm of networks is a place where these roles are at least as important as in the more pure realms of computing, such as algorithms and software engineering. Yet there are also differences. Networks are based on hardware and software structures and their interactions. These interrelationships have proven to be very amenable to modeling. In this module, we present some of these models. Many of the models look at the same environment or circumstances from different perspectives (sometimes called being looked at "orthogonally"). To minimize confusion, you, as student and learning IT professional, should be careful to differentiate the models and their properties.

3. The Network of Networks

The worldwide data-sharing infrastructure called the Internet can be viewed as a network of networks based on the Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols. Each host system exists in a local access network such as an office local area network (LAN) and/or the local communications facilities of an Internet service provider (ISP). The local access networks are typically grouped together into common architecture networks (which also support some form of non-Internet usage) that eventually are connected to the Internet backbone formed by the national service providers (NSPs).

4. Application Distribution

The end goal and result of the shared infrastructure which is the Internet, and in smaller ways, smaller networks, is the distribution of applications among the hosts of the network. Whether an application is client-server or peer-to-peer, connection-oriented or connectionless, or single-threaded or parallel-processed (or even some intermediate or combination), the network serves to facilitate this objective.

Electronic mail (e-mail), file transfer, and virtual session emulation are the three traditional building-block applications of the Internet. In reality, it is impossible to come up with a static list of "basic" applications because the Internet is a dynamic environment; previously unknown applications are developed and used all the time. Some newly developed applications may eventually become permanent additions to our toolkits. Consider instant messaging! How about electronic commerce (e-commerce)? What of peer-to-peer file sharing? All of these have been integrated, through the World Wide Web (WWW), and its associated browsers. The WWW (or "the Web") distributes complex applications among the multitude of hosts and environments interconnected by the underlying network (usually the Internet). The Web has been so successful that you probably don't clearly differentiate the building blocks from it unless you have had the opportunity to use each independently. Many of you have used e-mail as a standalone application but not the others. In this course we will give you the task of using the historic building blocks (in the lab assignments) and comparing them.

5. The Forest of Protocols

A protocol is a set of rules governing the exchange of data between two entities. Because of the large numbers of protocols in networking, knowing which to use in a particular situation seems to be an overwhelming task. If you understand how the architecture fits together, however, and where in the architecture a protocol applies, you can go a long way toward unraveling this Gordian knot. Some former students of this and similar courses consider mastery over protocols one of the most important accomplishments of their computer-related academic career.

Perhaps the most difficult concept in layered architectures (see section 7 below) is fan-in or fan-out of data. Because layered network architectures are intended to facilitate multiplexing, the protocols provide ways of accomplishing data fan-in and fan-out. For an example of what fan-in and fan-out allows one to do, consider a typical file transfer session. At the highest level, data are identified for transfer as one file. But not even internally do computers transfer even a 10-megabit file as a single unit. The file is actually transferred as a sequence of smaller blocks. In networking, breaking a BLOB (binary large object), in this case the 10-megabit file, into small units and transferring each individually with its own control and error-checking capabilities results in more efficient use of the transmission facilities.

Yet the user is insulated from all these procedures. What may not be obvious is that each layer in an architecture, likewise, insulates the layer above it from any need to know how many actual data transfers had to be performed to accomplish the transfer of the single object passed to the layer. The layers transparently segment (fan-out) data passed to them and reassemble (fan-in) objects received from the network into single objects to be passed to the higher layer, insulating higher layers of the need to know anything about the underlying data transmission.

It may take hundreds of objects at a given layer to accomplish transfer of the single object passed down from a higher layer. Making this transaction even more complex is the fact that the layer may be interleaving several such transfers at the same time and multiplexing over the real or virtual connection to a remote host. The two communicating layers can only manage this complex task because each object passed over the connection is encapsulated with address, error-detection, and other protocol controls. The protocol makes a semantic information exchange between layers possible by using a syntax both layers understand.

6. The Structure of the Cloud

A network has physical structure because it is built of components and connections. By and large, components are either "edge" devices where "computing" is performed or "core" devices where data transfer is managed. This partitioning of components into two classes is useful because it allows us to discuss characteristics of the "edge" and the "core" without getting bogged down in details.

Pictorially, as a result, networks are often represented as "clouds" with or without specific detail highlighted or superimposed to emphasize that only general characteristics are being discussed and that detail is being omitted.

7. Layering, Layered Network Architectures, and Multiplexing

a. Physical and Virtual Connections

Device-based multiplexing, as you should recall from studying data communications, provides benefits for co-located or closely located device pools that can share a single transmission medium. In short, this type of multiplexing consists of the physical connection of multiple devices with virtual point-to-point connections between pairs of devices. Software-based multiplexing, on the other hand, is what makes computer networking possible. Networking differs from simple multiplexing in that it provides virtual connections between large numbers of devices over multiple shared physical connections.

Specifically, networking is rooted in statistical time-division multiplexing (STDM or statistical TDM, also known more simply as statistical multiplexing). In STDM, each block of data transmitted over the physical connections is preceded by control information that determines the device or port to which the receiver delivers the data. Similarly, in networking, each block of data transmitted over the physical connections is preceded by control information that helps the receiving device determine what to do with the data.

b. Virtual Ports and Devices

Once you have made the leap to the concept of virtual connections, as in STDM, you do not have to go much further to accept the possibility of having multiple virtual connections in a single physical device and sharing the connection hardware as well as the transmission hardware. A PC on a LAN may have only one physical networking port that is connected to only one physical wire, but when loaded with appropriate software, the PC may be maintaining active virtual data connections with many other machines on the network, apparently simultaneously. All virtual connections are kept separate from each other because each is assigned to a virtual port with associated tables of control data that are updated based on the contents of the control information in the header of each received block.

Keeping all of this straight requires fairly complex software. Initially, complex networking subsystems were built to address networking unique to each implementation. The developers who built these early subsystems had to be highly skilled in many areas (these areas correspond to the layers in the layered architecture) to address this level of complexity.

When faced with a complex problem, the good system designer tries to break the problem into small, simple pieces that are easier to comprehend. Using this approach, which is sometimes referred to as modularization or divide-and-conquer, each module or group of modules has an implementation secret, which means that the details of how the module performs its task are not public. The internal data structure and the algorithm used, for example, are thereby hidden from the calling modules, hence the name information hiding. The advantage to such an approach is that these details can be changed without modifying the calling modules. This is also called information hiding and supports the concept of divide-and-conquer.

Similarly, the approach used for communications and networking—using a layered architecture for the communications subsystem or network—applies the divide-and-conquer approach to the problem of transferring data reliably and quickly. (Although the whole point of a layered architecture is to use the divide-and-conquer strategy, layered architectures are also used for other purposes in operating systems, but we need not address those here.) Each layer of the architecture, just like each module of a complex system, needs to have a well-defined job of manageable size for this approach to work. Each layer, just like each module, needs to have an implementation secret so that the layers are independent from each other.

The following basic principles apply to a layered communications architecture:

· In general, a layer is a piece of software or hardware or a combination of the two.

· Each sender layer communicates control information to its matching receiver layer via an agreed-upon protocol.

· A sender layer requests services from the next (sending) layer below it in the protocol stack.

· A receiver layer delivers a communicated entity to the (receiving) layer directly above it.

· Layers are functionally independent. The choice of a protocol at one layer should not affect layers above or below it.

· A layer may be null if it is not required for the full interconnection session.

c. Layer-to-Layer Interface

Each layer in a layered architecture introduces the need for more overhead in transmission. By networking overhead, we mean those bits in the data transmission that do not appear in the original data input into the protocol stack by the user/application. If designers and implementers are willing to tolerate a large amount of overhead, there must be some benefit to offset the accompanying large cost—and there is! A layered architecture provides a great deal of functional modularity. If the architecture is properly designed, making changes to one module (at one layer) does not have a ripple effect on the operation of other layers (modules). Other less obvious benefits are associated with the reduced complexity of standard specifications and development based on smaller modules.

The layers in network architectures are grouped in several different ways. Suffice it to say that for all such architectures in use today, the closer you are to the bottom of the protocol stack, the more hardware-oriented you are, and the more standardized the hardware is.

The key to a layered architecture is the concept that each module/layer communicates with only three other entities:

1. the layer/module above it in the protocol stack—for service information for the current layer and data

2. the layer/module below it in the protocol stack—for service information for the subsidiary layer and data

3. its peer layer/module in the protocol stack on the remote host—for data and control specifications

The figure below demonstrates how data are transferred through a four-layer architecture (similar to TCP/IP). Successively clicking on the STEP button will walk you through this process.

Figure 1.1 Transferring Data through a Four-Layer Architecture

d. The Open Systems Interconnection (OSI) Model

The Open Systems Interconnection, or OSI model, developed by the International Standards Organization and thus, international in scope, is the logical structure on which to base the discussion and standardization of data communications. It is a layered communications architecture consisting of seven layers:

Application : layer 7

Presentation : layer 6

Session : layer 5

Transport : layer 4

Network : layer 3

Data Link : layer 2

Physical : layer 1

The layers are numbered from a communicator's viewpoint in that the first layer, physical, is the one that actually reaches out and touches the communications environment.

But what does open system interconnection mean? Well, perhaps the folks who worked on the model had in mind allowing systems that are designed as utilities (e.g., CompuServe, AOL, *Prodigy, MCI Mail, Hotmail, and MSN) to work together. The current OSI environment seems to have been significantly expanded with an emphasis on open systems. The objective has been widened to include any computer and/or process that has been designed according to a set of open system specifications (some of which are national and international standards; others of which are proprietary standards where the sponsor has made them open).

Other changes have occurred since the OSI model was originally conceived:

· The data link layer has been defined as having two sub-layers: medium access control and logical link control.

· The network layer has been defined as having three sub-layers (to support internetworking): subnetwork independent convergence, subnetwork dependent convergence, and subnetwork dependent access.

· Network management, which initially seemed to have been ignored, is now considered part of the reference model environment.

Changes to the model are likely to continue, but no radical changes are anticipated. Although the forces that brought the OSI model into existence appear to have been well intentioned and well supported, few pure OSI implementations seem to exist. The preeminent networking architecture is the TCP/IP suite. Mixed OSI/TCP/IP networks also exist as it is fairly easy to replace ISO layers 5–7 with TCP/IP application layer entities.

On a given computer (host), several networks may be attached and several protocol stacks may actually be in parallel use. For example, your installation may be running SMTP (simple mail transfer protocol) from the TCP/IP suite, but be attached to both a TCP/IP network and an OSI network. In this case, the application would fan-out, selecting the appropriate transport protocol with which to communicate to a specific computer's mail connection. Were this an OSI-only situation, the session layer would be responsible for properly managing the required mail connection. If, on the other hand, you had two mail applications (e.g., X.400 and SMTP) running in parallel over a single network connection, there might be a fan-in to the single transport layer entity.

e. The TCP/IP Suite

The TCP/IP model, the result of many years of evolution and experience, is remarkably parallel to the OSI model. The primary difference is that the top three layers of the OSI model are represented in the single application layer in the TCP/IP model. Much of the same functionality is present in both. Another major difference is that most TCP/IP applications are defined for a single data representation, whereas the presentation layer in the OSI model makes it possible for applications to operate in a fashion independent of the data representation. You will have a chance to use several of the TCP/IP applications in this course.

Applications are generally connection-oriented rather than connectionless, which means that the first thing your application agent program needs to do to send Internet mail, transfer a file, or emulate terminal services (or any of the other application services) is to establish a channel through which data will pass to a remote host. The destination host typically has listener applications (frequently called daemons) running for all of the services it is willing to provide to requesting hosts. On the Internet, these listeners are most often assigned to and monitor specific virtual port addresses known as well-known ports. Thus if a given host does not support the application for which a well-known port has been designed, no listener monitors that port number, and requests destined for the associated port end up being ignored (alternatively, a listener may be monitoring and send back a "reset" packet indicating the request was heard but is being rejected). Additionally, listener applications can be replicated to a different port number (normally outside the "well known" range) and that application can be made available to clients who know the uncustomary port assignment. Commonly used well-known ports and associated protocols include: Telnet on port 23, SMTP (email) on port 25, SSH (secure shell) on port 22, HTTP on port 80, and FTP on ports 20 (data) and 21 (control).

When a request is received using the appropriate protocol with the proper virtual port address, the listener sets up an application of the proper type and assigns an unused virtual port address outside the well-known range that will be used by the session. It then sends a reply to the requesting host (to the virtual port address from which the request was received) including the virtual port address assigned to the application it just set up. In special circumstances, the listener application can handle all requests itself. The Web is an example of such stateless operation.

Note that the protocols used at the lower layers may be either connection-oriented or connectionless. Certainly the message to the listener application, because of the simplicity of the job the listener performs and the minimal amount of data required to perform it, does not need to have a pre-established connection. TCP is actually the connection-oriented protocol at the transport or host-to-host layer. The connectionless protocol at the same layer is known as UDP (User Datagram Protocol).

TCP/IP has one other architectural difference from the OSI model that should be mentioned: layers can be bypassed. The OSI has a strict rule that a layer (or sub-layer) must always be present even if all the service requests result in duplication of the request to the next lower layer—essentially a null layer. TCP/IP's architecture permits bypassing unnecessary layers and delivering service requests directly to the module that can act on them.

8. Data Switching, Routing, and Delays

a. Switching Concepts and Circuit Switching

The networking concept of switching has its roots in the manual switchboard as is often pictured in early films and TV shows, typically, in a scenario such as the following:

The human operator notices an incoming call, connects a wire to that incoming line and to his or her headset, and asks whom the call is for. On receiving a response, the operator connects the wire to the destination line, removes the headset from the circuit, and the ring signal is sent to the destination line. At the end of the call, the operator disconnects the wires so they are available for the next call.

Eventually, the human operator was replaced by electro-mechanical equipment and then by electronic equipment that accomplished the same tasks, namely:

· determine the destination and the route to the destination

· set up a circuit for the route to transmit the call to the destination

· transmit data as the call progresses

· release the circuit when it is no longer needed

Circuit switching accomplishes this on a "per call" basis. A circuit is set up at the beginning of the call, kept in place for the relatively long duration of the call, and released for reuse at the end of the call. In contrast, packet switching (discussed below) accomplishes the same functions using less time and smaller quantities of signal. The familiar voice telephone system is the primary example of circuit switching.

A dedicated communications path is a good news/bad news situation for the units participating in the call. Full use of the capabilities of the service is provided for the duration of the call, but for the entity providing the service, the assigned resources are unavailable for any other use for the duration of the call. Periods of heavy usage result in calls not being established because some necessary resource is not available (a busy signal in the public switched telephone network (PSTN) is one result). Service providers can overcome this restriction only by expanding resources and reducing the percentage of time the average resource is doing work. Such capital investment often can be accommodated only by increases in fees charged.

In studying networks, it is important to understand the implications of the amount of time required for signals to transfer across a physical connection between two points. This time delay is called the propagation delay. The single biggest factor in doing such calculations is understanding the propagation delay.

To calculate the propagation delay you need to know only three factors:

· the length of the medium (between those two connected points)

· the velocity of transfer through the medium

· data rate

Signal velocity in all media in use for networking is almost the speed of light in a vacuum, which is 3 × 108 meters per second.

Propagation delay is a measure of time, so the result of calculation must be in some time dimension, such as seconds or hours.

Now you have all this information, but you may not know a formula beyond the basic high school physics formula d = rt. But perhaps you remember the following trick from that same high school physics class: See if the units in a problem can be arranged to produce the right result. If they can be arranged to do this only one way, you probably have the formula. For example, you know that:

Seconds = meters / meters per second (Hey! That works!)

Therefore, for a ten-meter-long medium that transfers data at 80 percent the speed of light:

Propagation delay	= length of medium / velocity of transfer
	= 10 m / (0.8 × (3 × 108 meters per second))
	= 4.17 × 10−8 sec

This calculation determines that it takes a bit 4.17 × 10−8 seconds to traverse a ten-meter wire.

You may ask, "Since a bit takes time to go between two points, does this imply that if the distance is far enough with respect to the velocity, more than one bit may be in the wire at one time?" To which we would answer "Yes! Very good observation! Congratulate yourself for seeing that one!" You have just uncovered one of the main differences between LANs and WANs: WANs operate with technologies in which propagation delay has no impact on the network design, whereas LAN technologies break down if the propagation delay becomes too great.

To calculate how many bits are in the wire at a given instant (actually, the maximum number), you already have everything you need. Simply multiply the propagation delay by the data rate. (How about that, the units cancel properly!) So, 4.17 × 10−8 seconds multiplied by, for example, 10 megabits per second equals your answer: in this case, 0.417 bits (just under half a bit—but it's a short cable and a fast data rate).

b. Routing and Control in Circuit-Switched Networks

In any network, the ease and efficiency with which a switching node handles routing decisions has much to do with the quality of the service that is provided. In circuit-switched networks, a request to establish a call must be handled fairly rapidly or the subscriber will hang up and try again, which usually has a negative effect on the network (and, if it happens frequently, the service provider may eventually lose a customer). When a request to establish a call is received, the network must first determine what is the best subset of the resources available to handle the request, and then assign them.

In the PSTN, most central offices have only one path available to a requested destination (although that trunk may be capable of handling multiple connections) because the network is basically a hierarchy or tree. Whether a path is available can be determined instantaneously and that part of the path assigned, if it is available. This process is repeated for each node until the actual destination is reached or a resource is unavailable. The originating caller receives either a ringing tone or a busy tone when the destination is reached. Such a routing pattern is called a static routing algorithm.

To make better use of their resources, the long-distance companies use more complex routing and interconnection patterns in high-usage trunks toward the top of the network hierarchy, which requires more complex routing algorithms to be used for those nodes. You may have guessed that these more complex routing patterns are referred to as dynamic.

Within dynamic routing there are two classes: alternate routing and adaptive routing. These classes are based loosely on how frequently the parameters (historic or current) for the routing decisions may change. Alternate routing is relatively unchanging and is based on historic patterns of usage. Adaptive routing is more instantaneous and based on what the pattern of usage has been over a relatively short, recent period.

Control signaling is the means by which the nodes in the network communicate with each other and manage the resources of the network. An example of subscriber-to-central-office control signaling is a subscriber dialing a number. An example of node-to-node control signaling is the notice from an alternate or intermediate destination that a call cannot be completed (a needed resource is unavailable).

Control signals may be exchanged either over facilities set up specifically for that purpose (common channel signaling) or over the facilities that are used by the non-control signals (inchannel signaling, either "inband" or "out-of-band"). Each technique has advantages and disadvantages, such as cost.

c. Packet-Switching Networks

Circuit switching, designed to handle voice traffic, grew out of the telephone networks. Packet switching was developed to address problems in circuit-switching networks that were not apparent in analog voice networks. Data communications lends itself to sharing resources (thus packet switching) because the circuits that support a single connection are often idle for significant portions of the call. If a technique for using the resources during that idle time could be developed (and it has), the idle periods could be reduced, enabling smaller facilities to support a higher volume of traffic.

The underlying concept of packet switching is that data is divided into small pieces (sometimes called packets), each of which contains sufficient header information to permit the network to deliver it over shared facilities to its destination. Just like simple STDM, each block or packet of data includes addressing information. But instead of just a connection ID (as in simple STDM), the destination is identified with a unique ID (either virtual or actual).

Once delivered into the packet-switching network, each packet is treated as an independent entity. At each node, a routing decision is made and the packet is queued for delivery to the next node. The individual links between nodes operate, as should be apparent from this discussion, just like an STDM link, with packets crossing the resource in unpredictable order. Note that, unlike circuit switching, there is no dedicated path between origination and destination.

In circuit-switched networks, propagation delay contributes the major part of the total delay between transmission and receipt. Signals propagate over communications links at almost the speed of light. With a dedicated path completely at the disposal of a call, there is negligible delay between transmission of a bit and its delivery, even for transcontinental calls.

This is not the case in packet-switched networks. The node delay contributes most of the delay in such networks. Node delay is the time interval between receipt of the first bit at the node and when the last bit is transmitted to the next node. During this time, the entire packet must be received and stored in a buffer. Next, the header must be stripped off and the routing decision must be made. Then the buffer must be copied to an outgoing queue of buffers and a new header affixed. Finally, the packet must be transmitted over the link. In the Internet, this may occur 20–30 times between source and destination.

d. Routing and Control in Packet-Switched Networks

In the design of packet-switched networks, routing issues are the source of significant complexity. Because routing decisions directly affect the number of hops (a hop is loosely defined as the number of nodes a packet visits between source and destination) a packet requires for delivery, the apparent performance of the network is directly related to the routing procedure used. In fact, the number of hops for a given packet may be limited through use of the TTL ("time to live") field in the packet headers—a packet whose TTL has been decremented to zero is discarded.

Many protocols and techniques for packet routing have been developed over the years, and service providers are likely to experiment endlessly to improve their procedures. Basically, packet routing is based on a combination of collecting performance criteria for the network and choosing, based on an analysis of these criteria, between the available pathways to the destination.

Simply put, the major function of the routing algorithm is to assign the packet to an outgoing queue. The length of that queue is also a significant factor contributing to node delay. The situation in which the queue length is large enough to cause long node delay is referred to as congestion. Congestion can best be addressed by taking actions that reduce the traffic arriving at the node in the congested queue. The performance criteria used in the routing decision should include the congestion factor.

Packet-switched networks are organized using two approaches: datagrams and virtual circuits. In the approach using datagrams, packets are free to find their own way through the network. In the approach using virtual circuits, all packets travel through the network on the path established by that virtual circuit.

In the datagram approach, each packet contains the full network address of its destination, and routing decisions are made based on the current condition of the network as each node that handles the packet sees it at the time. Virtual circuits use virtual circuit identifiers in headers instead of full network addresses. Once the initial determination of the routing has been made, the node makes no decisions on routing for data packets—the virtual circuit identifier is looked up in a table and the packet is queued for transmission on the previously assigned outbound port.

The network keeps track of the virtual circuits by having each node maintain its own table of the active virtual circuits that pass through it. Each line of the node table represents a different virtual circuit. Each virtual circuit is identified by both the circuit number of the node that the packet comes from and the circuit number of the node that the packet is going to.

To help you understand how virtual circuits work, first look at the circuit diagram below and the examples of some of the virtual circuits that originate on the hosts at Node A and Node F. Then look at the demonstration illustrating the operation of a virtual circuit network using the diagram and corresponding node tables.

9. Information Assurance and Network Security

The mission of networks is to share within a community. The goal of information assurance is to limit the sharing to those who should be a part of the community. These two objectives seem to work counter to each other; a good information assurance approach is a balanced one that does not unnecessarily stifle the sharing aspect.

What exactly is information assurance? According to the National Security Agency (n.d.), it is "the set of measures intended to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities."

The security services of availability, integrity, authentication, confidentiality, and non-repudiation are often referred to as the five pillars of information assurance. Figure 1.2 below depicts these five pillars:

Figure 1.2 The Five Pillars of Information Assurance

Source: Adapted from Money, A. L. (2000). Annual information assurance report: Fiscal year 2000, p. 7. U.S. Department of Defense. Retrieved September 26, 2008, from http://www.defenselink.mil/cio-nii/infoassurance/diap/documents/DIAP2000.pdf

Back in the late 1970s when the OSI model was being developed, information assurance was not yet a major consideration. Computer networks were still in their infancy, making access by hackers difficult. The Internet of today did not exist at this time although some of its roots were there. However, as the Internet became more prevalent and more, potentially unauthorized, users gained access to networks, information assurance became a priority so that networks and the data that traveled on them would be protected.

The consequence of a layered architecture such as the OSI model is that information assurance design must associate protections with each layer, enabling the specific layer to best reduce the targeted risk in the least invasive manner. For example, using encryption at the presentation layer protects the data but may leave the details of the actual exchange exposed and vulnerable. Encrypting at the transport layer, on the other hand, can protect more details but potentially interferes with the effectiveness and efficiency of some of the protocols used.

An information assurance model devised by Maconachy et al. (figure 1.3) can be used to relate information assurance to networks. This model is an extension of an earlier information security model developed by John McCumber. As shown in the figure below, computer networks (i.e., the transmission layer) are represented by the top row of the "Rubik's Cube." The five pillars of information assurance ("security services") are shown across the top, and security countermeasures (e.g., technology) are on the right face of the cube.

Figure 1.3 Information Assurance Model

Source: Adapted from Maconachy, W. V., Schou, C. D., Ragsdale, D., & Welch, D. (2001). A model for information assurance: An integrated approach. Proceedings of the 2001 IEEE workshop on information assurance and security, United States Military Academy, West Point, NY, 5-6 June, 2001, p. 307, fig 4. Retrieved September 26, 2008, from http://www.itoc.usma.edu/Workshop/2001/Authors/Submitted_Abstracts/paperW2C3(55).pdf

The tier or "layer" of this information assurance model most applicable to the content of this course is "transmission" and you will note that each of the information assurance pillars has an intersection with that tier (on the left face of the cube, among "information states"). As we proceed on through this course we will be discussing these intersections.

10.The History of the Internet

Spend some time with the history resources provided on the Web by the Internet Society, which contains several good historical descriptions of the Internet.

Had the fictitious Mr. Phelps of our introduction received his task in the 1960s and been one of the fathers of the Internet, how well do you think he succeeded? Has the task been accomplished?

Module 3: The Transport Layer

1. In the Middle of It All

The heart of networking is in and between the transport and network layers. This may already be obvious to you because you have "term recognition" for "TCP/IP," but there are strong logical and conceptual reasons for this to be so. We will cover the transport layer in this module and cover the network layer in module 4.

From one perspective, we can say that the uppermost layers of network architectures provide for communication between user processes by establishing a common reference language that reduces ambiguity. The lowest layers of network architectures employ locally unique protocols and are concerned with movement of bits between two points connected by a common communications environment.

In the middle are the transport and network layers. The transport layer, which is typically implemented by TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), uses port numbers to provide connections between processes on two hosts across a network. TCP is used to provide reliable, full-duplex communications. UDP provides communication without TCP's reliability (i.e., data that is lost in transport is not automatically re-sent from the transport layer when using UDP). The network layer, in which you will usually find implementation through the ubiquitous IP (Internet Protocol), uses logical addressing to route packets between hosts on a network. This process ensures that data can cross any communication environment between two hosts.

The network model provides for multiplexing and sharing on multiple levels and in different ways. One multiplexing role of these layers is to facilitate sharing of network connections between two hosts by multiplexing any applications of the two into a single data stream when simultaneous transport of data is possible (hence the name application multiplexing). Because many client-server and even peer-to-peer transactions end up being solo and non-simultaneous, application multiplexing across the network at the transport layer may not occur very frequently for a given host-to-host session. When there are multi-programmed (or even multi-processed, as discussed below) applications on a given host and these applications are using different companion/destination hosts, then applications multiplexing will still be necessary within the network stack on that given host (as illustrated in the textbook), providing "fan-in/fan-out" of the data stream among the upper-layer processes. The functions provided by the middle layers make both "flavors" of application multiplexing possible by separating process addressing (via port numbers in the TCP and UDP headers) and host addressing (in the IP header). An example application that makes use of both flavors of multiplexing is FTP, where the communications relating to control are transferred via a port-21–initiated conversation and those relating to actual data transfer are via a port-20–initiated connection.

Multi-processing has gained importance in recent years due to the extended use of distributed processing resulting from a more global perspective in information systems. (Note that the follow-on course to this one is on the topic of distributed systems.) The need for additional processing power has resulted in combining the resources of many separate PCs together resulting in the concept of a computer cluster. Such loosely coupled parallel systems can offer hundreds of times the processing power of a single system. Further, they are made available by extending the capabilities of networks by adding a layer of software such as MPI (message passing interface) that allows each of the nodes within a cluster to communicate with each other and work together as one. It is not uncommon to reduce a problem that would take a year to solve on a single processor down to 11 days when solved on a 32-node cluster.

Moving forward, we will try to be careful about the use of two terms: datagram, which really should be used only to reference the packages passing between entities at the network layer, and segment, which is the general term for packages of data that pass between transport layer entities. Note that the interesting outcome of this set of definitions is that the segment passed using UDP is not properly called a datagram even though this term is in the name of the protocol!

2. Connectionless Service—UDP

Connectionless service at the transport level adds very little function to the network model. Because application multiplexing is critical to the transport function, it is provided for by such a service. As an exemplar of a connectionless transport service, UDP simply adds port numbers (and thus, multiplexing) to the application segment(s) and passes them down to the IP (network layer) for further processing. UDP also calculates or verifies a checksum (based on header fields, the IP protocol in use, and host addresses).

The UDP transport service requires no verification that the requested service (associated with the destination port and/or address) is available. At the host (assuming it exists—if it doesn't, the segment is discarded by the network), the application data is delivered to the identified service (if it exists) or simply discarded. No error recovery is attempted by the transport service. Applications employing UDP for application service requests frequently use timeout to determine whether the requested service could be performed and, if it could not, will attempt error recovery or initiate an alternative request.

Major advantages of connectionless service (as typified by UDP) are:

· Reduced network overhead traffic—the exchanges associated with making and breaking connection are not required.

· Reduced transport layer overhead—there is no need to maintain data-enabling functions such as connection state, buffering, and congestion control.

· Reduced packet overhead—the UDP header is 8 octets in length, whereas the TCP header is 20 or more octets.

· Unregulated send rate between hosts—note that the implication of this advantage is that segments may not be delivered if congestion occurs.

The following is an illustration of the UDP segment format. Place your cursor over the individual elements for additional information.

$C:\Users\Jeremiah\Desktop\1.png$ $C:\Users\Jeremiah\Desktop\2.png$ $C:\Users\Jeremiah\Desktop\3.png$ $C:\Users\Jeremiah\Desktop\4.png$

An astute observer would note that one of the principles of the ISO model would seem be violated by the checksum field because it involves fields not in the transport layer header (and thus, this is one way that the TCP/IP model might differ from the ISO model). This is not really the case, however. UDP provides connectionless service. This means that all data necessary to deliver the application data must be provided first to the transport level and then passed down to the network level (and vice versa). Thus all the data necessary to calculate the checksum is resident within the domain of UDP at the time the calculation must be performed.

3. Connection Oriented Service—TCP

Reliable data transfer between applications is the job of the transport level. The implication of this statement is that the network level (the next lower layer) may be unreliable and have some probability of delivering a data unit at the receiver that contains at least one bit that has changed state (from 0 to 1 or 1 to 0) from the original request at the sender. We will not go into an extensive discussion here regarding finite state machines or other theoretical constructs. (Resources including such discussions are widely available, including some in your textbook, should you wish to know more about such aspects.)

Major advantages of connection-oriented service (as typified by TCP) are:

· Applications can simply pass a stream of data to the transport layer and assume that delivery has taken place or they will be notified of irrecoverable failure. This sequence greatly simplifies communications handling processing.

· Undelivered segments are automatically re-sent to account for unreliability in lower layers.

· Receiver can "throttle" or regulate the rate of transmission and other characteristics associated with the transmitter. This feature helps limit the impact of network congestion.

Native computer speeds are significantly greater than the highest network backbone speeds available, even in LANs. Sharing of links via multiplexing among hosts likely cannot overcome the enforced idleness of high-speed links when wait time is multiple orders of magnitude greater than actual data transfer time. Pipelined transfer protocols are thus desirable over the stop-and-wait processing that would be the direct result of designing simply for reliability.

Once we conclude that pipelining is necessary, we need to look at the two ways of handling error recovery when this technique is used: selective repeat versus Go-Back-N recovery. The bottom line is that selective repeat requires significant investment in hardware requirements and complexity at the receiver that is unnecessary when Go-Back-N is used.

For selective repeat, the receiver must buffer any data segment received out of order until all its predecessors have been received error-free. Because Go-Back-N discards any data segment received out of order and requires the sender to retransmit in order, the hardware necessary to implement buffering and the complex logic necessary to reassemble data segments can be omitted from the design. There is an impact on network bandwidth but even in congested situations, the actual increase is of minor significance due to the throttling of sending rate that is the consequence of congestion.

Where the underlying network design does not guarantee delivery in the same order that segments are sent, Go-Back-N pipelining introduces some interesting complications. Chief among these is the need for a maximum "packet lifetime." Because TCP/IP and other layered network architectures cannot make the assumption that delivery sequence is guaranteed, this maximum is implemented in the Internet. In some cases, there may need to be other means of ensuring that sequence numbers are not erroneously reused.

TCP, the exemplar for a reliable transfer-connection-oriented transport-level protocol, is a point-to-point protocol between two specific processes, presumably operating on two different hosts. Note that the term socket, although often used informally to mean "port," actually means the combination of "port" and "host." (Typically the IP address is interpreted as the actual distinguishing value for the host.) For this reason, TCP is occasionally referred to as "socket-to-socket."

When TCP is in use, a connection is first established (although some would argue that verified might be a more understandable term for what really happens). The application requests the connection by providing the host and port identifiers. The TCP module then uses what is called a "three-way handshake" to establish the connection:

1. The originator sends a TCP segment with the SYN bit on and a starting sequence number value for the originator-to-responder connection (usually randomly generated), and no data.

2. The responder sends a TCP segment with the SYN and ACK bit on, a starting sequence number value for the responder-to-originator connection (likewise, randomly generated), an acknowledgement number one more than the sequence number received in the first segment in the handshake, and no data.

3. The originator sends a TCP segment with the SYN bit off and the ACK bit on, an acknowledgement number one more than the sequence number received from the second segment in the handshake, (optionally) the first data to be transferred, and the appropriate segment number value.

Data can now flow reliably in both directions, as illustrated below.

The following is an illustration of the TCP segment format. Place your cursor over the individual elements for additional information.

$C:\Users\Jeremiah\Desktop\5.png$

$C:\Users\Jeremiah\Desktop\6.png$

$C:\Users\Jeremiah\Desktop\7.png$ $C:\Users\Jeremiah\Desktop\8.png$ $C:\Users\Jeremiah\Desktop\9.png$ $C:\Users\Jeremiah\Desktop\10.png$ $C:\Users\Jeremiah\Desktop\11.png$ $C:\Users\Jeremiah\Desktop\12.png$ $C:\Users\Jeremiah\Desktop\13.png$ $C:\Users\Jeremiah\Desktop\14.png$ $C:\Users\Jeremiah\Desktop\15.png$ $C:\Users\Jeremiah\Desktop\16.png$ $C:\Users\Jeremiah\Desktop\17.png$

Exercise

To help yourself appreciate the difference in overhead between use of TCP and UDP, complete the following exercise once you have access to a sniffer. Your instructor can provide you with instructions on how to obtain a sniffer and may have already included this information in an assignment or with the syllabus. Once you have worked through the exercise, discuss it with your classmates.

1. Start your sniffer and set it to capture TCP.

2. Use your browser and connect to a Web page.

3. Save a single TCP session with a short data segment (one packet) from the Web page to a text file.

4. Reset your sniffer to capture UDP.

5. Identify a single UDP transaction.

6. Save it to another text file.

7. Compare the lengths of the files and the number of packets necessary to accomplish a similar transfer.

8. Conclude how much overhead is generated by the use of TCP over UDP.

4. Handling Congestion

Congestion in networks is a common occurrence. The primary associated causes and result (or costs) include:

· large queuing delay as link bandwidth capacity is approached

· increased retransmissions as a result of lost packets

· unneeded retransmissions due to delayed packets, based on timeouts

· wasted bandwidth associated with lost packets

Congestion can be handled end-to-end (and thus, by the transport level) or within the network (and thus, by lower network levels). TCP handles congestion in an end-to-end fashion. By limiting the number of transmitted segments that have not yet been acknowledged (the window size), the transmit rate is limited. Each connection being managed by TCP has associated with it a current window size that has been "agreed to" by the two hosts and internal values for the current congestion window and threshold. Based on these values, the TCP process will throttle its activity according to specific algorithms.

For example, the illustration below shows the flow of packets in a Sliding Window protocol with a window size of 3.

One of the interesting algorithms used by TCP is called "slow start." Starting slowly helps limit congestion and needless retransmissions. Effectively, this procedure starts out with a small window size anticipating that there might be restricted capacity somewhere between the two hosts. Each time an ACK is received by the originator, the congestion window's value is increased by one segment until it reaches the "advertised" window size associated with the destination. In the event of a timeout or a duplicate ACK, the congestion window can be reduced to limit the impact of congestion and recycle the procedure.

Sally Floyd of AT&T was instrumental in the congestion control design of TCP. You may want to review her work and biography.

5. Information Assurance

The transport layer provides some strong information-assurance services but also suffers from significant vulnerabilities. From the perspective of the five pillars of information assurance, the transport layer has the following security issues:

· Confidentiality: The Secure Sockets Layer (SSL) protocol, which has become the Transport Layer Security (TLS) protocol, provides a mechanism for Web browsers to exchange sensitive confidential information (e.g., credit card numbers) with HTTP servers. Most other transport layer services, however, do not provide confidentiality services.

· Integrity: SSL and TLS, through the use of cryptographic hashes, ensure that a third party has not tampered with messages. In addition, TCP and the Stream Control Transmission Protocol (SCTP) ensure data integrity with respect to transmission errors. TCP sits on top of IP and compensates for IP's known unreliability by providing checksum, flow control, and sequencing information.

· Availability: The transport layer is highly susceptible to denial of service (DoS) attacks, which can adversely impact network availability.

· Authentication: SSL and TLS authenticate both network clients and servers to each other. TLS uses client digital certificates to support encrypted authentication for e-mail correspondence. TLS is used to encrypt the clear-text password sent by the basic authentication method. The use of TLS for e-mail applications is mostly applicable towards the communication between two SMTP servers when transmitting e-mail messages.

· Non-repudiation: Although SSL and TLS protocols fulfill most of the five pillars, non-repudiation services are not directly provided by the transport layer.

Aside from these security concerns, transport layer protocols contain additional security threats and liabilities including DoS attacks (mentioned above) and session hijacking threats:

· DoS attacks cause a network service to become unavailable either by shutting down its port or by overloading it with an abundant amount of network connections.

· The "ping of death" attack, for example, is based on sending a modified formed IP packet to a computer. The recipient's network service shuts down because it can't send an acknowledgement to the actual sender.

· Session hijacking occurs when a hacker takes over an existing connection between two computers. The hacker will send packets resembling the actual sender and fool the recipient into sending subsequent packets to the hacker itself, allowing the hacker to use transport layer protocols such as TCP to communicate with the recipient.

NON-PERSISTENT AND PERSISTENT CONNECTIONS

HTTP can use both non-persistent connections and persistent connections. Non-persistent connections is the default mode for HTTP/1.0. Conversely, persistent connections is the default mode for HTTP/1.1.

Non-Persistent Connections

Let us walk through the steps of transferring a Web page from server to client for the case of non-persistent connections. Suppose the page consists of a base HTML file and 10 JPEG images, and that all 11 of these objects reside on the same server. Suppose the URL for the base HTML file is

Here is what happens:

· The HTTP client initiates a TCP connection to the server port number 80 is used as the default port number at which the HTTP server will be listening for HTTP clients that want to retrieve documents using HTTP.

· The HTTP client sends a HTTP request message into the socket associated with the TCP connection that was established in step 1. The request message either includes the entire URL or simply the path name.

· The HTTP server receives the request message via the socket associated with the connection that was established in step 1, retrieves the object from its storage (RAM or disk), encapsulates the object in a HTTP response message, and sends the response message into the TCP connection.

· The HTTP server tells TCP to close the TCP connection. (But TCP doesn’t actually terminate the connection until the client has received the response message in tact.)

· The HTTP client receives the response message. The TCP connection terminates. The message indicates that the encapsulated object is an HTML file. The client extracts the file from the response message, parses the HTML file and finds references to the ten JPEG objects.

The first four steps are then repeated for each of the referenced JPEG objects.

· Citrix remote access clients

· Microsoft Terminal Services

· Microsoft's browser-based graphical terminal services client

· terminal services applications that run on hand-held devices

3. The World Wide Web

The World Wide Web is an application that uses a client browser to access server applications. The basic lingua franca of the Web is the HyperText Markup Language (HTML), which was derived from an earlier language called Standard Generalized Markup Language (SGML) by addition of the function of hyperlinking and other extensions. Browsers actually facilitate the use of many application protocols (including Telnet and FTP) and applications (including e-mail). The use of hyperlinks, HTML, and the HTTP protocol is the unique enabling application associated with the Web. The enabling functional concept is the Uniform Resource Locator (URL), which specifies the application protocol to be used for a link and the target object to be referenced by that application.

HTTP servers send requested files without storing and retaining any state information about the client. If a client repeatedly asks for the same file in multiple successive transactions, the server will comply and send it out multiple times because the server has not saved any information on recent interactions. Although HTTP is a stateless protocol (and thus connectionless), it can simulate connections through the use of cookies. Basically, an HTTP GET is a request for delivery of an object/file and includes specification of two major parameters: a host address on which that file object may be located and a path name for locating the object.

HTTP is usually run on top of TCP (more on this protocol later) and the transport layer is thus connection-oriented. However, after the page is transferred completely, the session is often ended by the browser, so effectively we see multiple short-lived connection-oriented sessions instead of a continuously open session similar to what one would expect from the Telnet service. This is a further emphasis that the design of HTTP is based on not maintaining state information about clients. Again, cookies are used to simulate connections as described above.

The browser can also implement caching and only retrieve items not in its current store of previously retrieved items. Conditional transfer is implemented by checking the "last-modified" date-time on the server against an "if-modified since" parameter in the HTTP request packet. This straightforward mechanism can cut down significantly on retransmission of file objects. Further, the network can implement appropriately distributed "proxy" caches located between groups of hosts. This latter mechanism can be used to reduce retransmission over long transmission paths for popular objects.

4. File Exchange and FTP

Another client-server application protocol of the Internet is File Transfer Protocol (FTP). Like HTTP, FTP is used by clients to retrieve objects from servers. FTP can also be used to store objects on those servers, reversing the data transfer flow. The client process has a set of commands that it translates into the internal FTP command set that it sends as requests to the server process. Some FTP client processes use the command set of the local operating system and some (for example, WS-FTP client) have implemented a graphical user interface (GUI) for navigation and control. The producer of WS-FTP client also sells an FTP server program and includes a discussion of the merits of using FTP for file transfer service relying on the capabilities of HTTP and e-mail attachments (see Ipswitch). Note that FTP, like Telnet, SMTP, and HTTP (and others), pass all data “in the clear.” The Secure Shell application is often used to set up an encrypted tunnel between two hosts to overcome this security and information assurance issue.

5. Secure Shell (SSH)

As noted, passing all exchanges between hosts constitutes a security risk and you should not use this approach unless, as has been said by wags, “… you want to see it published in The Washington Post tomorrow.” The Secure Shell service provides a solution, based on public key encryption (PKE), to reduce this risk. SSH first authenticates the client, server, and optionally the user using PKE and certificates issued by trusted agents. After the login, an encrypted tunnel may be maintained between the two machines and other protocols/services may be used across the tunnel. The well-known port associated with SSH is port 22. SSH version 2 is covered by RFCs 4251 through 4254. If you use PuTTY to access UMUC Unix systems, you are using SSH and addressing the risk associated with Telnet.

6. Electronic Mail and SMTP

Electronic mail (e-mail) is so basic to networks that many users could not conceive of the infrastructure without that application available. Historically, SMTP was designed based on the assumption that a user had a terminal that was nearly always available online and had a printer as a primary display. If the terminal was not available, the message could not be sent. If you analyze the command set, this bias can be detected, but beyond understanding how the application evolved, it is probably not important for you to be concerned about this. Over the years, e-mail has evolved to the current more complex situation with agents and mailboxes and message stores, which we all seem to use.

Modern e-mail uses an agent on the client to manage the user's mail store and manipulate outgoing mail as well as incoming mail services. Most outgoing mail that leaves the local network employs the SMTP application protocol, although some mail agents implement ISO/CCITT X.400 between known hosts. Most incoming mail is maintained on a server until accessed by the user agent and removed by that agent. User agents have also been made available as Web pages allowing users to manage their mail without a local user agent. Common incoming mail service protocols in use today include POP3 and IMAP. The design assumptions for POP3 include user agents having their own mail store and the server store being emptied frequently. In IMAP, the main mail store is presumed to be on the server. Most user agents today support both protocols and user mail stores are often maintained on both client and server, irrespective of the protocol in use.

An example of a conceptual e-mail transfer many be found in UMUC's OSI model learning object. Within the model, click the Application layer tab, then the Real Life Example side-menu button. Press the Play button to begin the example. (Be sure to turn your speakers on to hear the audio.)

7. The Domain Name System (DNS): The Directory Service of the Internet

The Internet is currently supported by a hierarchical set of directory servers called the domain name service (DNS). A more distributed database of directory information, ISO/CCITT X.500, including e-mail addresses for individuals and organizations, has been proposed and some implementations exist within smaller networks, but not for the Internet at large. In DNS, each host has a small number of DNS servers from which it obtains its direct services. If these DNS servers do not know how to resolve a particular host name, they have additional DNS servers above them in the hierarchy to which to refer the request. This request referral can take place recursively until the root DNS server is contacted. The root server can refer the request down a different branch of the hierarchy to an authoritative name server for the domain being referenced. The resolving host then communicates the response to the originating DNS server. Most servers in the hierarchy also cache any replies received so they can respond directly if the request is again received.

Figure 2.1 below briefly illustrates the host-name resolution process.

Figure 2.1 Name Server Query Example

$C:\Users\Jeremiah\Desktop\1.JPG$ $C:\Users\Jeremiah\Desktop\2.JPG$ $C:\Users\Jeremiah\Desktop\3.JPG$ $C:\Users\Jeremiah\Desktop\4.JPG$ $C:\Users\Jeremiah\Desktop\5.JPG$ $C:\Users\Jeremiah\Desktop\6.JPG$ $C:\Users\Jeremiah\Desktop\7.JPG$ $C:\Users\Jeremiah\Desktop\8.JPG$ $C:\Users\Jeremiah\Desktop\9.JPG$ $C:\Users\Jeremiah\Desktop\10.JPG$

8. Ports, Sockets, and Services

Application services are identified on the receive side through a well-known port number. Many of these port numbers can be found in RFC 1700. Others not found there are established by "agreement" between a client and server. When a TCP or UDP packet is received (some ports handle only one of the two), the port number specified is used to determine the process to receive the associated data after the headers have been stripped off.

Socket programming has become a specialty among IT personnel. By-and-large this programming is accomplished through use of a library of functions/routines provided by the vendor of the TCP/IP stack or operating system.

9. Information Assurance

The application layer is really the "network application" layer—the access point at which the user or user application gains access to the services of the network. The application layer should not be confused with user applications (i.e., programs) such as Excel or a Web browser. User applications use the application layer to communicate with the network.

From the perspective of the five pillars of information assurance, the application layer faces the following issues:

· Confidentiality: Using the application layer's FTP service, a network intruder may attempt to access confidential information in a user's machine.

· Integrity: Using the application layer's Telnet service, a network intruder may attempt to destroy or corrupt data from a remote location.

· Availability: By using application layer services to corrupt system files, a network intruder may deny a user's timely, reliable access to databases or remote services.

· Authentication: A user application may use application layer services to authenticate that he/she is authorized to access certain information via the network.

· Non-repudiation: A user application may use application layer services to prove that he/she was the actual sender of a message.

Some information assurance implications in terms of the five pillars and application layer services are summarized in table 2.1 below:

Table 2.1 Information Assurance Implication Summary

$C:\Users\Jeremiah\Desktop\table_app.gif$

Here is an example of how a hacker might launch a cyber attack using application layer services:

· The hacker builds a virus and embeds it within a file.

· He attaches the file to an e-mail and uses his e-mail client (a user application) to send the infected message through his application layer SMTP service and across the network.

· The infected message travels across the network to the victim's machine and up the OSI stack to the victim's application layer.

· The victim's machine is also running a user application e-mail client that utilizes the application layer SMTP service.

· The unwitting victim opens the e-mail, and his e-mail client writes the infected file to his hard drive.

· The infected file uses the application layer SMTP service to transmit copies of itself via e-mail to other machines on the network.

There are many ways that the information assurance threats at the application layer can be mitigated. A few examples follow:

· FTP: The File Transfer Protocol service can be turned off unless absolutely needed. If it is turned on, logons by anonymous users should be disabled. If anonymous logons are a requirement, they should be carefully configured and administered.

· Telnet: This protocol allows a user to logon to a computer over a network. As with FTP, this service should be turned off unless absolutely needed. If it must be used, it should be configured to disable logons after repeated failed attempts to logon. Consider use of SSH and PuTTY if possible to address this vulnerability.

· HTTP: The Hypertext Transfer Protocol is vulnerable because it transmits unencrypted information (such as credit card numbers) over the network. The use of the Secure Hypertext Transfer Protocol (HTTPS) mitigates this threat to confidentiality by encrypting data prior to transmission.

At the "people" layer, network users can help achieve information assurance. In our hacker example above, user training might have prevented the unfortunate opening of a suspicious e-mail.

Note that the ISO model recommends that data encryption be performed at the presentation layer (which for the TCP-IP situation is subsumed in the application layer). From the perspective of the five pillars of information assurance, the security services of confidentiality, integrity, authentication, and non-repudiation can be implemented using encryption and related cryptographic techniques.

The presentation layer is uniquely suited to provide these security services because the application layer above it is dealing with business-level entities such as e-mail, documents, Web pages, and so forth. The presentation layer is the last layer in which the application content is still whole and can be protected as a single entity.

In general, designers of distributed systems need to take steps to secure information, verify identities between processes, and verify signatures. All of these tasks are usually accomplished through some form of cryptography. Cryptography is the use of encryption algorithms and their associated keys, which are applied to plaintext data to produce encrypted (ciphertext) data. Cryptography is used in different ways to safeguard data and systems. In addition to data encryption, cryptography is used for digital signatures (to provide non-repudiation), authentication, and key distribution.

Module 4: IP: The Network Layer

1. In the Middle of It All (Continued)

As you learned in module 3, the heart of networking is in and between the transport and network layers. In the middle is (a) the transport layer and (b) the network layer. The transport layer (typified here by TCP and UDP and discussed in module 3) has the job of handling a common reference language for the applications and translating it to and from a series of bits that can be reproduced for delivery between the originating and the destination processes. The network layer (typified here by IP) is where the bits are packaged for passing between hosts across any intervening communications environments, started on their way through the intervening communications links, and received at the destination host and passed back up to the application there.

Recall the multiplexing role of these layers: to facilitate sharing of network connections between two hosts by multiplexing data between applications of the two into a single data stream. The transport layer involves only two module entities (one at the source host and one at the destination host) that handle the protocol and process data for movement between two processes. The network layer, however, involves entities at and requires coordination from every network node in the network (although some are involved indirectly).

2. Services of a Network

The role of the network layer is to accept a data segment from the transport layer, package it into a network packet, and forward it on its journey until it reaches the host at its final destination where it is unpackaged and returned to the transport entity there. The network layer does all this by providing three critical network layer functions:

1. routing or path determination

2. switching to the next communications link along the path

3. call setup if required by the network for the needed communications links

You might accurately observe that the transport layer thus appears to operate independently of the specific characteristics of any underlying networks, whereas the network layer matches the transportation requirement for host–to–host communications with the actual intervening infrastructure available. Call setup for virtual circuits (when required) thus becomes a multi–phased process in which numerous individual circuits are established between intervening hosts involved in passing the packets. Each link in the virtual circuit path must be aware of the connection and prepared to pass the packets to the next host involved in the relay.

An interesting observation is that the overhead involved with conveying data through the network layer is allocated between bandwidth and router hardware. Virtual circuit networks are connection–oriented and allocate more of the overhead to the routing hardware; datagram networks (such as the Internet) are connectionless or "best effort" and allot the bulk of the overhead to the bandwidth of the links. From a simplistic global design perspective, the network layer service model used (virtual circuit versus datagram) determines where you make your engineering investments—link bandwidth or node hardware. This determination, in turn, can affect the cost of the overall solution.

Of course, we also make engineering investments based on our experiential view of the universe. Computer scientists look upon networks as a means of connecting computers and extending these "end systems" by providing access to remote resources. Thus, the best–effort model seems to make sense when the universe centers on the local computer. Communications engineers look upon the connection as the whole reason for existence. Thus the guaranteed service model of the switched circuit and its evolutionary offspring, the virtual circuit, makes sense from that viewpoint.

3. Routing Principles

The network layer uses a routing algorithm to determine how a packet (the general name for a network layer protocol data unit) gets through the network at least cost. This sounds like a simple task, but the reality is that the term cost is a deceivingly complex item. Frequent components of cost include:

· dollars, when traffic–sensitive charging is in use

· speed of the link(s)

· queuing delays of the link(s)

· policy and politics associated with network ownership

Another major objective of a routing algorithm is the mitigation or prevention of "routing loops" where packets enter the network and are cyclically routed between the same set of nodes and never reach their destination. Without features to address the problem of routing loops, bandwidth would eventually be entirely consumed with transferring packets that never reached their destinations.

Routing algorithms generally involve two approaches:

1. global routing, which employs a link state algorithm where every node in the network must be aware of the cost associated with each link in the network from which it can calculate the cost of a proposed path

2. decentralized routing, which employs a distance vector algorithm where each node knows only the neighbor to which it should forward a packet to reach a given destination along the least–cost path and the cost of that path

Link state algorithms are supported by having each node in a network broadcast the identities of its attached neighbors plus the cost of the associated links.

Distance vector algorithms require each node to exchange its own calculated least–cost factors for each reachable destination with its neighbors. The neighbors then update locally maintained tables, recalculate as appropriate, and exchange any updated values with their neighbors if there is a change.

Routing algorithms are an instance of the mathematical discipline of graph theory. In this discipline, a graph is composed of two components:

1. a series of points or nodes—in the case of network routing algorithms, these are the routers involved in making decisions about routing

2. a series of arcs or edges, which express relationships (in the case of networks, connections) between those nodes

For purposes of the algorithm, each edge has an associated cost. The task is to find the path through the graph that has the smallest cumulative cost for all edges traversed. You should be able to easily find extensive description and discussion of several example routing algorithms and how they work. For static algorithms, the costs associated with an edge are established at the time the network is engineered and change relatively slowly and infrequently, often as a result of external intervention. Dynamic algorithms are intended to respond rapidly to changes in conditions, such as variance in traffic load or device failures. The sensitivity of dynamic algorithms subjects them to the effects of potential volatility. Note that the cost definition and the calculation algorithm associated with edges is often called the routing metric. Routing algorithms determine where to send packets based on the value of the routing metric associated with a final or intermediate destination in the local routing table.

Load–sensitive algorithms for routing react to the congestion in the network; whereas load-insensitive algorithms do not adjust for congestion. Thus, there are three different (or orthogonal) ways to classify a routing algorithm:

1. global or decentralized

2. static or dynamic

3. load–sensitive

The Internet uses two types out of the eight possible classes: dynamic global load–insensitive link state (e.g., in the Open Shortest Path First [OSPF] protocol) and dynamic decentralized load–insensitive distance vector (e.g., in the Routing Information Protocol [RIP] and the Border Gateway Protocol [BGP]).

The Internet also partitions the routing problem into hierarchical domains, each called an autonomous system (AS). An AS is considered solely responsible for routing within its own domain. As a result, the Internet routers are concerned with delivering packets to, from, and via an AS. This partitioning greatly simplifies the complexity of the computation required but leads to two domains of interface problems for those routers: (a) interface between Internet routers, and (b) interface with an AS. This simplification has significant benefits as the total number of hosts accessible from the Internet increases by leaps and bounds as it has done in recent years. This partitioning also fits from a political and administrative perspective, allowing, as the name implies, autonomy within each organization regarding operation of its own property. RIP and OSPF are used within an AS, whereas BGP is used inter–AS.

4. Internet Protocol (IP)

To provide the critical network-layer functions applicable to the Internet already discussed, namely, routing and switching (recall that call setup is not required for the connectionless, best–effort design of the Internet at the network layer), IP provides components with the following functionalities:

· path determination protocols, including routing-table updates (via RIP, OSPF, and BGP, for example) and an algorithm for path selection

· network protocol details, including addressing schemes, packet (called a datagram for IP) format, and packet–handling conventions

· internode management protocol, facilitating error–reporting and other information exchange between network nodes

a. IP Addresses in IPv4

The current IP, version 4 (IPv4), was designed with five classes of address to accommodate wide variance in network size and needs. It was originally conceived as robust and unlikely to be a limiting factor, but the explosive growth in devices needing interface to the Internet has revealed weaknesses in the original addressing scheme. In the long term, a new IP, version 6 (IPv6), has been engineered to eventually replace the current version. For the short term, the Internet routers have been reprogrammed to eliminate dependence on those five classes and free up a significant number of addresses that were previously unusable because of the class scheme.

First, let's understand the classes:

· Class A was intended to allocate blocks of IP addresses to the largest networks servicing millions of hosts. The 32–bit IPv4 address has a zero as the first bit, a 7–bit network identifier, and 24 bits for host ID.

· Class B was aimed at medium–sized networks with thousands of hosts. The address starts with a binary 10 followed by 14 bits for network ID and 16 bits for host ID.

· Class C was aimed at small networks with up to 254 hosts. The address starts with a binary 110 followed by 21 bits for network and 8 bits for host.

· Classes D and E serve multicast, special–purpose, and experimental networks.

Over the years, an allocation problem developed. With such a wide divergence in the size of three blocks of addresses available for allocation to organizations, the Internet didn't so much run out of address space as accumulate a large quantity of unusable addresses that had been allocated and either could not or would not be given up by the owners.

Fortuitously, the engineers of the Internet (the Internet Engineering Task Force, [IETF]) identified a minor change that would be beneficial to this situation. Over the years, the larger (and many medium–sized) networks were divided into subnets internally so that routing could be facilitated locally. Classless Inter–Domain Routing (CIDR), implemented in 1993, extended the subnet concept to routing between networks. Thus, the address classes are no longer a part of Internet addressing. The terminology persists, however, and many networking personnel still use the class designations for convenience.

Note also that routers seldom need full cognizance of the whole Internet structure. By skillful engineering and allocation by the Internet Corporation for Assigned Names and Numbers (ICANN), the use of route aggregation, and the fact that routers need only switch packets between a small number of connected links, routing tables can be kept locally simple. Routers also can make use of default routes to which any packets are sent that do not have known "next link" paths.

b. The IPv4 Datagram Format

The following is an illustration of the IPv4 datagram format. Place your cursor over the individual elements for additional information.

$C:\Users\Jeremiah\Desktop\Capture.JPG$

i. Fragmentation and Reassembly

Not all networks can convey packets of arbitrary length. When routing across a network with a smaller maximum transfer unit (mtu) than the originally transmitted packet length, the network layer responds by breaking the packet into smaller pieces called fragments at the border of the network with the small mtu. These fragments are reassembled at the destination host before being passed to the transport layer.

For example, an Ethernet frame can be either 1,514 or 1,518 bytes (depending on the version and type of Ethernet frame), 1,500 of which can be data. (But be careful here, data in a frame—the data link layer entity—can actually contain header and control structures inserted by higher layers such as IP or TCP, for example). The MTU for some wide-area links is 576 (a specific example might be frame relay). Therefore, the IP packet must be fragmented into multiple frames by intermediary devices. Below is a frame pictorial showing the tiered headers.

LLC Header	IP Header	UDP Header	Application Data	CRC
14 octets	20 octets	8 octets	1,472 octets	4 octets

Only the LLC (logical link control) header and the CRC (cyclic redundancy check) are frame overhead. Total overhead would also include the IP and UDP headers and possibly some application control information not shown above.

Many applications use the TCP push feature or other means to limit the size of IP packets sent on the network. (In fact, many use that above specified MTU of 576 irrespective of the attached network's MTU). This limitation reduces the necessity of fragmentation and associated reassembly at the destination.

ii. Control Messaging

Internet hosts and routers exchange control messages using the Internet Control Message Protocol (ICMP). ICMP is not, as such, a separate network-layer protocol, but actually rides as payload data in an IP packet.

iii. Routing Protocols

The following chart of various routing protocols in common use shows the rich variety of work that has been done in developing and adapting protocols to specific uses. (Place your cursor over the green letters for full text of acronyms.)

5. Router Architecture

A router is essentially a special–purpose computer consisting of three major components:

1. input ports that receive packets from links, perform any processing necessary for the physical and data link layers, and queue packets for insertion into the switching components if needed

2. output ports that receive packets from the switching components, queue packets for actual transmission, and perform any processing required for the outgoing data link and physical layers

3. switching components that analyze incoming packets, determine the routing necessary for the next increment of the path, and deliver the packet to the output port

Routers and switches must be able to move large buffers of data quickly between input ports and output ports, thus minimizing the intra–router delays. Most of the advances in router architecture thus appear centered on the switching components, most specifically, the "switch fabric" through which the data is transferred and the routing processor that controls the processing. Such hardware and architectural features enhance the speed and dependability of current router systems.

6. IPv4 to IPv6 Transition

The textbook (and other resources you may identify—there's even an IETF document discussing the issues) includes a discussion of the difference between IPv4 and IPv6. Of particular interest is the issue of how and when to make the transition to IPv6.

a. Features of IPv6

IPv6 includes the following features:

· expanded address space: 128 bits versus 32 in IPv4

· The "biggest" change and the one everyone concentrates on.

· streamlined fixed–length header (only 40 octets)

· Yes, this is longer than in IPv4, but the "streamlining" is the fact that it is now fixed length, which can be processed much more expeditiously than a variable-length header as used previously. Besides, the options in IPv4 were seldom used and nearly all IPv4 headers were 20 octets long. (In fact, because source routing is one of the options supported by the variable-length characteristic and some autonomous systems restricted this, headers longer than 20 octets are sometimes blocked by nodes and routers). The expanded address space (96 bits [or 12 octets] added for both the source and destination addresses) accounts for more than the added length (only 20 octets).

· support for mobile systems

· support for what is often called streaming or flow transfer

· ability to differentiate between many different classes of transfer (an 8–bit field is used)

b. Representing IPv6 Addresses

Once you accept that 128 bits are necessary for IPv6 addresses, you are left with the problem of how to represent them so they are readable to human beings (computers are just as comfortable with reading a 128-bit address as they are with reading a 32-bit one—they just need to know what the task is). The format of address representation commonly used for IPv4 is called "dotted quad" or "dotted decimal." The address is broken up into four 8-bit groups and each group is represented as a decimal number with a value from 0 to 255 (such as 131.171.11.22). If we were to continue this pattern for 128 bits, we would need 16 groups instead of 4. This is fairly unwieldy and in some cases won’t even fit on a single line in a document or program.

To address the problems outlined above, the decision was made to employ a colon-separated hexadecimal notation for the human-readable form of IPv6 addresses. The 128 bits are grouped into 16-bit words and each word is represented by up to four hexadecimal digits. This means there are only eight groups necessary to represent the entire address. There are also some shorthand conventions for IPv6 addressing:

· leading zeroes can be suppressed in each group

· groups with the value of zero can be represented by placing the leading and trailing colon adjacent

· a few special addresses have special representations

· if an IPv4 address is encoded in the last 32 bits, it can be represented by its dotted quad equivalent

c. Special Addresses and Address Types

There are three types of addresses defined for IPv6: unicast, anycast, and multicast.

Unicast addresses are uniquely assigned to a single interface card, just like in IPv4. There are three subtypes for different circumstances:

· Link-local addresses are represented by an address containing a leading hexadecimal group of fe80::. Routers do not forward packets with link-local destination or source addresses.

· Site-local addresses are represented by an address containing a leading hexadecimal group of fec0::. Routers do not forward packets with site-local destination or source addresses, except to other locations on the same site.

· Global addresses are designed for use on any network and are represented by an address containing leading binary digits of 001. This is the equivalent of the familiar addressing in IPv4 to the unreserved portions of classes A, B, and C.

Anycast addresses are used for a set of interfaces, perhaps at multiple locations, that all share a single address. The packet may be delivered to any one of these interfaces, the "nearest."

Multicast addresses are used for a set of interfaces, perhaps at multiple locations. The packet is delivered to all active members of the group. The first two hexadecimal digits of a multicast address are ff.

The unspecified address is 0:0:0:0:0:0:0:0 and may never be assigned to a host. It indicates the absence of an address.

The unspecified address has a special shorthand notation—"::".

The loopback address is 0:0:0:0:0:0:0:1 and may be abbreviated as "::1". Just like the familiar 127.0.0.1, the loopback address is used by a node to send a packet to itself.

d. Addressing in IPv6 during Transition

Suppose we are looking at polaris.umuc.edu. What human-readable addresses might be used for it once IPv6 is implemented but while IPv4 is still in common usage? (For illustrative purposes, we assume the first 96 bits of the IPv6 address assigned to Polaris are 21:ffff:aaaa:1111:0:0.)

· The IPv4 address—131.171.11.22

· The IPv4 loopback address for applications on the same host—127.0.0.1

· The IPv6 address with embedded IP—21:ffff:aaaa:1111::131.171.11.22

· The IPv6 loopback address—::1

· The full hexadecimal IPv6 address—21:ffff:aaaa:1111::83ab:0b16

· The domain name—polaris.umuc.edu

· The loopback name—localhost

Fairly obviously, even with the shorthand notations and the compact IPv6 forms, people will be more likely to use domain names than they would any of the colon-separated hexadecimal forms. This is, after all, the reason the domain name system was designed in the first place. After transition, only networking gurus and programmers are likely to use anything other than a domain name.

So, what do you think? Will IPv4 as the primary IP outlast your instructor's career? Will it outlast your career? Will extending technologies such as Network Address Translation (NAT) and Dynamic Host Configuration Protocol (DHCP) make IPv6 unnecessary?

7. Information Assurance

The Internet Protocol (IP) can be a gateway for intruders to gain access to your data. In terms of the five pillars of information assurance, the following threats exist at the network layer:

· Confidentiality: Network eavesdroppers may intercept and read sensitive information contained in IP packets.

· Integrity: Network intruders may alter the content of IP packets.

· Authentication: Network attackers may spoof the origin of IP packets.

The IP as defined in IPv4 does not directly provide information-assurance services to mitigate these threats; mitigation requires an additional level of security. If this security is implemented at a higher layer (say at the transport layer, as is the case for SSL), end-to-end security is achieved, but the implementation may be more complex. However, if the security is implemented at the network layer, the service is available to transport-layer protocols such as UDP and TCP, making it much more flexible and transparent to higher-layer applications.

IPSec is now available through a suite of protocols and algorithms that provide confidentiality, integrity, and authentication services for IP packets within the network layer. Authentication Header (AH) is an IPSec protocol that authenticates the origin of an IP packet and guarantees its integrity through cryptographic hash functions. Encapsulating Security Payload (ESP), another IPSec protocol, provides encryption to IP packets, thereby ensuring confidentiality

IPSec can operate in either transport or tunnel mode. Transport mode encrypts only the payload (i.e., data portion) of IP packets. This mode is used for secure communications between hosts. Tunnel mode, however, encrypts both the IP packet header and payload, thereby providing an additional measure of security and confidentiality. This mode is used for secure communications between network routers.

Because IPSec depends on public key encryption, a public key/certificate distribution service is required. This service is provided by the Internet Security Association and Key Management Protocol (ISAKMP).

Module 5: LANs and Local Loops

Networks cannot be built without the connectivity provided by a grid of transmission media on which to transfer data. The purpose of a number of industry standards is to make this grid available in a standard, consistent manner.

The other major component of the communications subsystem is the interface between the hosts and terminals and the communications devices. Here, standards also play an important role. Modems, interfaces, transmission media, and other such hardware components provide easy "plug-and-play" access to the world of networking.

The reality is that even with a multitude of "hard" standards (such as those referred to above) and apparent compliance, the "dirty," imperfect world in which data are communicated makes life difficult. This difficulty arises because copper wires, mechanical switches, radio signals, and so on are subject to many forms of interference and induced error. Over the years, the data communications industry has addressed such challenges by coming up with "soft" standards (both endorsed and de facto, called protocols) for data transmission, synchronization of transmitter and receiver, error handling, and multiplexing.

Without multiplexing, networks could not exist. Multiplexing is the combining of channels so that they share transmission media. In the broadest sense, networking is about providing cost-effective, maximum use of a physical communications grid.

1. Introduction

The minimalist view of the communications subsystem is a dedicated channel between two hosts through which data may be transferred at a designated rate. Data communications specialists often refer to this channel as a "pipe" and the data transmission rate as the "size" of the pipe. When appropriate standards exist and are correctly implemented by the vendors, we can simply say that the communications subsystem is compliant with a standard or a set of standards, and we can be assured that the hosts can operate with each other. Would that it were always that simple!

In reality, the communications subsystem becomes a nested architecture of connected pairs of hardware, some of which are visible and some of which are invisible. If, for example, you were to lease a dedicated circuit from a public switched telephone network (PSTN)—Bell Atlantic, for instance—you would view the circuit as two pairs of twisted copper wire. In fact, the PSTN might be transferring the data multiplexed on fiber-optic and microwave links but this would be transparent (or invisible) to the subscriber (you).

The other major component of the communications subsystem is the interface between the hosts—a computer or terminal, known in the communications industry as DTEs (data terminal equipment)—and the communications devices—such as modems, multiplexers, and DSUs, known collectively as DCEs (data circuit-terminating equipment).

Standards play an important role in the area of interfaces. Probably the oldest and most familiar standard in this area is American National Standard (ANS) EIA-232, which defines how to attach a modem to a terminal or computer in the United States. (In the international community, this standard is ISO V.24.) The existence of these standards has led to a brisk competition between many companies to sell modems that are increasingly more powerful and less expensive. What once would have cost thousands of dollars, even if it were available, is now sold as a commodity item (e.g., a 56 Kbps modem with fax capability).

Before looking at specific communications standards, it is interesting to note the various players in the communications standards arena. In many countries (not including the United States), communications is a government-operated monopoly run by those countries' postal systems. These government organizations are known collectively as postal, telephone, and telegraph agencies (PTTs) or telecom administrations (TAs). To PTTs or TAs, the recognized standards in this area come from the International Standards Organization (ISO) and the International Telecommunications Union (ITU), which formerly was known as the Consultative Committee on International Telegraphy and Telephony (CCITT). Within the United States, there are other standards organizations.

Device-based multiplexing provides benefits for co-located or closely located device pools that can share a single transmission medium. In short, this type of multiplexing consists of the physical connection of multiple devices with virtual point-to-point connections between pairs of devices. Software-based multiplexing, on the other hand, is what makes computer networking possible. Networking differs from simple multiplexing in that it provides virtual connections between large numbers of devices over multiple shared physical connections.

Specifically, networking is rooted in statistical time-division multiplexing (STDM or statistical TDM). In STDM, each block of data transmitted over the physical connections is preceded by control information that determines the device or port to which the receiver delivers the data. Similarly, in networking, each block of data transmitted over the physical connections is preceded by control information that helps the receiving device determine what to do with the data.

2. Principles and Services

Data are moved from one place to another over connections built by transmission media. Typically, most physical media forms are cables of copper wires, although other variations (such as fiber-optic or radio signals) exist. Even if radio signals are used, the signals are almost universally transferred over copper or fiber to get to/from the radio transmission sites. Installing physical media is expensive, no matter who does it, in terms of both the capital investment (the cables themselves and, possibly, rights-of-way) and the labor required to install and maintain the installation. As a result, there is a trade-off between capabilities desired (speed, reliability, and so on) and the cost of the implementation (media cost, right-of-way, labor, and so on). The emergence of "common carriers" has been the result of their ability to amortize the cost of installing the physical media on a shared basis over a large number of users and uses.

Transmission is often characterized by:

· the number of bits transferred at one time

· signaling

· data flow

· synchronization

There are also additional data transmission characteristics.

Data can be transferred between two locations using either digital or analog signaling. As computer folk, we are much more comfortable with digital transfer (the switch is either off or on) than with analog. The use of analog circuits for data transfer has an economic explanation: when the demand for data communications arose, the telephone analog networks were already in place. Change is coming, however; because of digital transmission's advantages over analog, the telephone networks are adopting digital techniques and the telephone systems are gradually converting to digital networks.

Historically, telegraphy (the digital form of message communication) was less prevalent in research and educational facilities than was the telephone and its analog transmission network. Although both the telephone and the telegraph have contributed to the data communications field, the telephone network provided the early transmission media.

The two DTEs in a communications subsystem operate independently. To communicate effectively, they must be synchronized to prevent the loss of data. Synchronization is a data transmission characteristic as discussed above.

The DTE (computer or other digital device) is connected to a DCE that translates the digital signal into an analog signal or another form of digital signal for conveyance across the transmission medium. The most familiar form of this interface is using an EIA-232–compliant cable to connect with a modem.

As you no doubt have already learned, all networking involves the generic concept of multiplexing. Multiplexing is simply the sharing of a single transmission medium or cable among multiple users or uses. This concept of resource sharing is important wherever expensive resources (in networking and data communications, the "long" transmission lines) are not employed efficiently by a single use or user.

Multiplexing between two locations is sometimes provided by a multiplexer (a mux), which is a dedicated device used (in matched pairs) at each end of a transmission line. The use of hardware multiplexers is only practical where there is a community of users, remote from a central resource, who can share a single transmission medium. Multiplexing through the use of multiplexers typically occurs in one of two forms: time division (TDM), which includes statistical multiplexing (STDM), and frequency division (FDM). Most computer networking is TDM.

TDM is the type of multiplexing in which the entire transmission medium's frequency spectrum is made available to a pair of devices for small slices of time. In "straight" TDM, these time slices are assigned to a given port on a multiplexer in a rotation sequence, whereas in STDM, they are assigned for use based on need. Buffering makes it appear that the use or user has full control of a smaller resource. FDM operates by electrically dividing up the available frequency spectrum (or capacity) into channels, each of which gets dedicated to a specific use or user.

3. Data Link Sub-Layering

When two DTEs communicate across a single link and they are the only devices sharing that link, the problem of managing that resource is fairly straightforward and easily understood. Many solutions have been designed for this circumstance (known as a point-to-point link) such as the Point-to-Point Protocol (PPP) and the High-level Data Link Control (HDLC) Protocol.

Where communication is across a link that is shared between more than two DTEs, the problem of managing the link becomes considerably more difficult. The multiple access situation is fraught with many more challenges yet is the basis for many local area network (LAN) situations—sharing resources among many devices in a small geographic area across a common link. Some techniques that have been useful in the data link layer multiple access situation have been:

· Channel partitioning—This method effectively uses TDM and FDM as the basis for managing the link.

· Code division—This technique effectively encodes the data in the signal multiple times according to known set patterns that allow the devices to detect the data even if the full code is not received.

· Random access—The primary feature of what is commonly known as the Ethernet protocols, access is attempted by a transmitter whenever it detects the link as idle and collisions (attempts by multiple stations to simultaneously use the link) are resolved by each sender in conflict stopping, waiting an arbitrary amount of time, and trying again. (Of course, many of the Ethernet implementations today are switched service for at least part of their run, resulting in significant minimization of the impact of this part of the Ethernet design on both performance and security. If there is only one active station on a segment, random access becomes a dedicated resource.)

· Taking-turns—This technique is essentially "polling" or token passing.

Further, developers and standardization organizations have discovered, as they have learned about the multiple access situation, that the data link layer work can be logically divided into two sub-layers (in addition to and above the physical layer services): Logical Link Control (LLC), where all non-physical services except "link access" can be performed, and the Media Access Control (MAC) sub-layer, where link access (the "sharing" aspects of managing a link) is performed.

4. Addressing and Address Resolution and LAN Hardware and Software

On a multiple access LAN each device has an address that permits the data link layer protocols to operate effectively. This LAN address (most often known as the MAC address after the sub-layer where it is properly of concern) is, essentially, hardware; it is permanently assigned to the LAN access device at some time before the LAN starts operating. One of the innovations that came about with the popularity of Ethernet was that these MAC addresses became an actual part of the hardware, hard-coded uniquely into the network interface card (NIC) at the time of its manufacture (in most cases this is in read-only memory and actually could be changed by replacing this piece of hardware, but such is seldom done because of the low unit cost of most NICs). The address space is managed in such a way by the standards organization (the Institute for Electrical and Electronics Engineering—IEEE) that assigned addresses are universally unique. IEEE accomplishes these unique assignments by partitioning the address into two pieces and standardizing the Organizationally Unique Identifier (OUI) portion (see the IEEE Registration Authority page on IEEE OUI and Company_id Assignments).

MAC addresses are typically 48 bits in length and the LLC sub-layer uses MAC addresses according to a relatively simple algorithm: if the destination address of a received frame matches the address on the NIC, the data are sent on "up the stack" to the device, otherwise they are ignored.

The Address Resolution Protocol (ARP) in operation within the Internet router attached to the LAN is charged with the duty of converting IP addresses to MAC addresses. This is very similar to how the Domain Name Service operates, although the indexes of the look-up tables (in this case, the IP address) are not designed to be easily "human-readable" as domain names are. The MAC address of the "gateway" router thus becomes the destination within the LAN for any address that does not resolve through ARP (and the gateway router takes care of any re-routing necessary outside the LAN).

Ethernet (actually an informal name for a large suite of protocols and LAN designs) has, for all practical purposes, become synonymous with LAN in the marketplace. It is by far the most prevalent technology and is likely to remain so for the foreseeable future. As one of the oldest LAN standards, and because there is an active standardization committee that responds to the advances in technology and the needs of the marketplace, Ethernet has many different implementation options—so many that a standard way of naming them concisely has developed (incomplete list):

· 10BASE5: 10 Mbps baseband 500 m coaxial cable (50 ohm) segment length bus

· 10BASE2: 10 Mbps baseband 185 m coaxial cable (50 ohm) segment length bus

· 10BASE-T: 10 Mbps baseband 100 m unshielded twisted-pair (UTP) segment length star

· 10BROAD36: 10 Mbps broadband 1800 m coaxial cable (75 ohm) segment length bus/tree

· 10BASE-FP (also FL & FB): 10 Mbps Manchester (equivalent to baseband) 1 km (or 2 km) fiber optic segment star

· 100BASE-TX: 100 Mbps baseband 100 m shielded twisted-pair (STP) or cat 5 UTP segment star

· 100BASE-FX: 100 Mbps 4B/5B / NRZI 100 m dual optical fiber segment star

· 100BASE-T4: 100 Mbps 8B/6T / NRZ 100 m dual cat 3/4/5 UTP star

Note that each version of Ethernet has a maximum segment length beyond which it will not work. This is a consequence of the multiple access protocol used and the length is chosen to ensure that the first significant bits of the header are received by all NICs before the last significant bit (of the header) has been transmitted by the sender. See if you can figure out why this is so (it has to do with the interaction of the various parts of the multiple access protocols and the definition used for a collision). For switched Ethernet, the primary factor in limiting the length of a run is the rate at which the signal degrades or decays as the length is increased.

5. Bridges, Routers, Tunnels, and other Hardware and Software

A nearly universal observation applied to computing is that the precise dividing line between what is hardware and what is software varies over time, usually, with hardware advances taking over for what had previously been done in software. In networking this is also widely true. The following (non-exhaustive) list of common and interesting devices includes both hardware and software functions and how they are often provided in the current marketplace:

· Repeater—The most straightforward communications device of all. Typically, considered a layer 1 device, the repeater does not require any address-handling functions. The incoming signal is sensed/analyzed and the outgoing signal is restored to "spec" (the technical requirements in the standard or other specification document).

· Hub—Effectively, a repeater where the signal is regenerated on multiple outputs. Also considered a layer 1 device not sensitive to addressing.

· Bridge—A "filtering" device in which the received frame is regenerated only on the output where it is destined (and thus removed from network segments which do not need to see it). The bridge typically operates at layer 2 on MAC addresses.

· Ethernet switch—Effectively, a high performance bridge. Designed to be used with one device attached to each of its multitudinous output ports. The Ethernet switch is, likewise, a layer 2 device operating on MAC addresses.

· Router—A store-and-forward device that operates above the data link layer (i.e., layer 3 or higher) and operates on "software" (most often, IP) addresses. Because it also does filtering at that level and LAN ARP duties, it usually can also be used to perform bridge duties.

· Wireless devices—Provide the ability to perform functions such as the above for devices not physically attached to the device. Radio, infrared, or other signaling is used to provide the link.

In addition, there are software and protocols that provide the above functions irrespective of how the physical interconnection is performed. The PPP is frequently used to provide "temporary" interconnect between a device and another node where service is available. The protocol essentially provides the same functions as HDLC, the protocol more frequently associated with more permanent links. Further, the PPP even makes use of some of the same protocol features, employing the "flag" sequence as the beginning and end of the frame and the likely familiar "byte stuffing" technique (in which any bit sequence indistinguishable from the flag has a special character inserted in front of it to signal that the next byte is not a flag) to ensure that an erroneously sensed flag cannot appear inside the frame.

Other interesting protocols (and hardware and software) support:

· asynchronous transfer mode

· frame relay

· streaming audio and video

· Internet telephone service

· real-time applications

· bandwidth reservations

With this array of services, it is possible to support multimedia applications across networks including the Internet.

6. Information Assurance

a. Data Link Layer

In terms of the five pillars of information assurance, data link layer issues fall mainly in the areas of confidentiality, integrity, and availability:

· Confidentiality: As you probably already know, packet sniffers are widely available to capture and analyze network traffic. A sniffer operates in promiscuous mode, allowing it to capture packets intended for other machines. A malicious network user can use a sniffer to capture login information (e.g., user IDs, passwords, and so forth) as well as other sensitive information. If a LAN uses hubs rather than switches, a given computer will "see" all packets on a subnet.

· Integrity: The integrity of network packets may be impacted by errors occurring at the physical layer no matter what their source. The data link layer can detect most errors using parity bits. Errors are generally corrected by requesting a retransmission of the entire frame.

· Availability: Several factors can impact network availability at the data link layer. Excessive traffic on CSMA LANs can result in packet collisions. Another (somewhat rare) event that impacts availability is a babbling node, caused by a failed NIC that is flooding the network with erroneous packets.

As usual, the most effective way to ensure confidentiality is through the use of encryption. Some data link protocols use it to provide data confidentiality as well as data integrity. Encryption at higher OSI layers will also thwart sniffing at the data link level. Sniffers, when used for legitimate purposes, can be used to analyze excessive bit-error rates, which can affect both data integrity and network availability.

Wireless networks pose the same data link issues as wired networks, but to a greater degree. It is much easier to intercept wireless packets because a physical connection is not required.

b. Physical Layer

To ensure data integrity at the physical layer, physical access to network facilities can be controlled, unused network connections can be removed, and cable and fiber runs can be inspected periodically for unauthorized taps.

Steps can also be taken to ensure network availability. First, cable and fiber runs should be installed according to standards to minimize bit errors due to electrical interference. Second, redundant/standby links can be provided to carry network traffic in the event of intentional or unintentional damage to a primary link.

Quantum communication (QC) is an emerging technology at the physical layer. QC offers the potential of absolute data confidentiality. The quantum information wiki and portal provides additional details about QC.

Module 6: Security and Network Management

1. Security and Risk Management

The only secure system is one that is in the center of an empty room with no doors or windows, disconnected from all power sources and communications channels (particularly wireless).

—A frustrated system administrator after a hacker attack

Of course, not even that system would be absolutely secure. Somebody could use a bomb to blow a hole in the wall and abscond with the system. The above was intended to be irreverent, but it really is a good expression of a reality. Security is always relative, and improvements in security are limited only by the price (in both dollars and restriction of function) that the customer is willing to pay.

Computer-system security and information assurance are topics of critical importance—in fact, UMUC has a semester-long course on the subject (in the IFSM discipline, for example), as well as related graduate and undergraduate certificates and majors. Network security is likewise an included topic of ever-increasing importance. Your textbook provides a large amount of information on the technical issues surrounding topics such as encryption, but you should be aware that other security techniques are used throughout networks, such as physical security of components. In other words, whereas passwords, certificates, and encryption are often the tools used to provide computer and network security, a full spectrum of risk reduction measures (such as personnel security and physical protection of assets) must be employed to have an effective security approach for networks and computers. No one technique can effectively address all security issues of a system.

Two additional examples of security techniques are firewalls, which attempt to prevent unauthorized communications from entering a sub-network, and TCP "wrappers," which use a special protocol to authenticate the host address (as recorded in the message headers) from which information is received. If you have compelling interests in the security field, you must learn significantly more than the small amount covered in this course.

2. Cryptography, Authentication, and Other Security Target Areas

Cryptography

Data encryption is big business. Data encryption also consumes resources from the system whether they be host resources or resources of dedicated equipment. Just how is encryption done and what are the protections provided? In the diagrams below, several different forms of encryption are described pictorially.

Simple Encryption

$C:\Users\Jeremiah\Desktop\fig6-1.gif$

In this most rudimentary form of data encryption, keys are part of the encryption algorithm and the algorithms are exchanged between trusted agents. Virtually no encryption is done this way due to the expense of creating such algorithms uniquely.

Conventional Encryption (Using a Public Algorithm, Such as DES)

With conventional encryption, the algorithm is standardized and a key (used as input data to the algorithm along with the original text or encrypted text depending on whether encryption or decryption is taking place) is shared between the trusted agents.

There are different modes (phases below) of implementing this type of encryption, depending on how the keys are shared, each successive phase being a stronger encryption technique than the previous. The most basic form is shown below.

Phase A: Key Sharing

The sender provides the key to all parties in protected conversation by some independently secure means (e.g., bonded messenger, separate encrypted network, and so on).

$C:\Users\Jeremiah\Desktop\fig6-1b.gif$

Phase B: Protected Conversation (in Either Direction)

Simple Public Key Encryption

In public key encryption, the key is not its own inverse as it is in conventional encryption. Rather, there is a decryption key that is never revealed to any other entity. Its inverse is the encryption key that is "publicly" provided to any intended sender/recipient of transmissions. The decryption key is also the inverse of the encryption key.

Like conventional encryption there are modes of use of different strengths (also called phases below):

Phase A: Key Sharing

Parties exchange a set of encryption and decryption keys to use in the protected conversation. The encryption key is publicly available. The decryption key is exchanged by some independently secure means (which is one of the vulnerabilities in the approach). The pictorial representation is below.

$C:\Users\Jeremiah\Desktop\fig6-2.gif$

Phase B: Protected Conversation (in Either Direction)

Public Key Encryption with Four Keys

A potential problem in public key encryption is that an intruder may be able to intercept the "public" key and send false transmissions. A partial solution to this problem, at significant processing expense, is to double-encrypt all messages using the sender's decryption key, followed by the recipient's public encryption key. The receiver then uses his or her own decryption key, followed by the sender's encryption key. This is called public key encryption with four keys.

Phase A: Key Sharing

Each party to participate in a protected conversation makes the encryption key and decryption key available to the other party. Encryption and decryption keys are symmetrical and can be used as the inverse of each other by the encryption algorithm.

$C:\Users\Jeremiah\Desktop\fig6-3a.gif$

Phase B: Protected Conversation (in Both Directions)

In order to further protect the transmissions, the decryption keys can be kept PRIVATE and never shared with another entity by using a further enhancement of double encryption (note that this limits "spoofing" by a sender who is not a recognized party in the exchange).

$C:\Users\Jeremiah\Desktop\fig6-3b.gif$

The U.S. Department of Defense and other enterprises are building large public key infrastructures (called PKIs by many) to protect their network resources and data (discussed further below).

Authentication

How does a party in a conversation establish the identity of the other party in that conversation? There are, of course, many approaches:

· Complete trust—I accept your claimed identity simply because you state that's who you are.

· Trust with additional data—You claim an identity, as above. You also provide a piece of data in "authentication" of your identity. This piece of data is something of which I have personal knowledge, increasing my level of trust. However, a third party, or "spoofer," could also know that piece of data and use it to impersonate you.

· Trust with shared data (key)—The data you provide in authentication has only been intentionally shared between you and I. Eavesdropping can compromise this technique.

· Public key verification of random data—The receiver chooses a random piece of data (called a nonce) and sends it to the claimant who encrypts it with the shared key and sends it back.

· Public key verification with anti-spoofing—Same as previous technique only the nonce is sent encrypted with the intended recipient's encryption key.

Message Integrity and Signatures

Signatures are a common means by which we verify that we agree with a message or document. When that object exists only in the virtual world, it becomes easy for a third party to revise it. An electronic signature is a method by which a sender can attach a facsimile of his or her signature to an object. If the electronic signature also includes features that allow a recipient to determine whether the object has been changed, it becomes what is known as a digital signature.

Certificates

A tool in resolving some of the issues noted in our discussion of cryptography, authentication, and message integrity is the employment of certificates. Certificates are actually a part of a public key infrastructure (PKI) and are the means by which an entity can authenticate an external entity through mediation with a trusted third party.

A simplistic explanation of this process is as follows: The trusted third party provides each entity with whom it has a trusted relationship with a fixed digital identity tag called a certificate. Then when entities want to authenticate each other, they exchange these tags and authenticate each other through reference to the trusted third party. Note that much of this exchange employs encryption as a basic tool.

The protocols applicable to certificates are described in RFC 4210 (RFCs 4211 and 4212 among many other others are on related certificate topics).

3. Security and Cryptography Approaches

The information assurance industry has successfully created and implemented a number of ways of handling security and cryptography. We'll briefly discuss some of them here.

Secure Sockets Layer (SSL)

Note: The below material is derived from an Internet Engineering Task Force (IETF) draft for SSL version 3.0, eventually published as RFC 2246 with the name TLS Protocol. See the original SSL Protocol Version 3.0 draft for discussion of SSL without the terminology and methodology changes reflected in RFC 2246, which is more technically accurate but doesn't reflect the language most commonly used in the industry. The draft referenced reflects how SSL is customarily implemented.

"The primary goal of the SSL Protocol is to provide privacy and reliability between two communicating applications (Freier, Karlton, & Kocher, 1996, p. 3)." SSL is application layer protocol-independent and has been commonly used to provide data protection between Web browsers, mail agents, FTP clients and services, and so forth. What is often called a tunnel is created on top of a reliable transport protocol by which the two SSL participants communicate.

The important characteristics of SSL are:

· "The connection is private. Encryption is used after an initial handshake to define a secret key.

· "The peer's identity can be authenticated using asymmetric, or public key, cryptography.

· "The connection is reliable. Message transport includes a message integrity check using a keyed [code] (Freier, Karlton, & Kocher, 1996, p. 3-4).

SSL is widely implemented and used. The IETF has generalized from the cited draft and there are later RFCs than 2246 that include details with varying amounts of industry acceptance and use.

IP Security Protocol (IPSec)

The IETF has also chartered a working group on IPsec. They are tasked to develop ways of providing protection in the network layer that employ cryptography in support of secure communications. The working group specifically addresses authentication, integrity, access control, and confidentiality.

You may want to review the working group's charter and links to its drafts and working papers. The referenced working group concluded its work in 2005 and subsequent work has been performed by a different working group. A proposed standard architecture for IPsec is contained in RFC 4301. RFC 2411, the IP Security Document Roadmap, should help an interested reader navigate the many drafts and RFCs the group has published. IPsec has been used fairly commonly, although not so widely as SSL because of the former's complexity.

Public Key Infrastructure (PKI)

Non-repudiation relates to adding to message integrity and authentication a means by which the recipient can accept the electronic or digital signature as "legally" binding on the sender. Of course, accomplishing this objective actually requires changes in rules, regulations, laws, and so forth. Merely providing the technical means to accomplish the function is insufficient. Attaining this target area objective requires significant cultural and non-technical change.

An attempt to incorporate many of these functions and capabilities into a unified infrastructure is represented by the development of PKI, which includes some technical solutions in the form of such things as:

· standard encryption/decryption algorithms

· key distribution centers

· public key certification (and certificate authorities)

As an example, the following data stream represents what might be transferred across the network as a digital signature:

-bash-3.00$ md5sum f1<CRLF><CRLF>897316929176464ebc9ad085f31e7284 f1

where "<CRLF>" represents a carriage return line feed sequence. It is obviously an encrypted data stream.

PKI has proven to be useful and flexible and will continue to help organizations achieve more secure networks in a consistent and widely usable fashion as it has within the U.S. Department of Defense.

Pretty Good Privacy (PGP)

Phillip Zimmerman at MIT created a cryptographic tool that he released as freeware allowing unlimited personal, non-commercial use for U.S. and Canadian citizens. It is also licensed by and distributed by a number of commercial organizations for commercial use. Many people use this tool on the Internet. A commercial firm, PGP Corporation, distributes this tool and its derivatives in many forms.

For those with a further interest in network security, perhaps to the point of desiring a security-related certification, we provide a list of prominent security-related organizations and network security certifications.

4. Access Control

The nature of the Internet is that it is an environment shared by all who use it. This sharing culminates in the almost total absence of constraints and the toleration of behaviors and activities that are objectionable to many users. Because these users are actually connected to communities and it is the communities that are interconnected, it becomes possible to isolate a community from objectionable activities (if those activities can be well-enough defined). This characteristic is the basis for the combined hardware/software component known as a firewall. Based on advances in software, personal firewalls that protect only a single host, usually a workstation or personal computer, have also become available, providing users with ultimate control of what network traffic actually makes it into the environment in which they work.

Firewalls (and other components) control access to resources attached to the network. If the enterprise or the user is willing to pay the price (both in dollars and in potential interference with network functions) of implementing such controls on access, these components represent a way to mitigate the risks associated with the openness of the Internet.

One of the most pervasive techniques used by the network "bad guys" to affect network resources is a denial-of-service (DoS) attack. Such an attack involves overwhelming a network resource (network segment, LAN, host, and so forth) with meaningless traffic that it must look at and discard. "Ping floods" are an example of a DoS attack. In such an attack the ICMP "ping" message is sent to a host or group of hosts as fast as the attacker can manage with the intent to block meaningful traffic. Note that some networks have disabled the ICMP "ping" function for this very reason.

Firewalls, particularly when implemented at gateways, can limit the impact of DoS attacks. The U.S. Department of Defense implements firewall techniques at the borders of its Internet connected networks, notably the NIPRNet (Non-Classified Internet Protocol Router Network). Such techniques can only limit the impact of such attacks because the traffic associated is still present on the higher bandwidth circuits. Additional gateway firewall blocking at lower points within the NIPRNet also prevents internal resources from performing such attacks.

You may be interested in reviewing some reports of network attacks and their aftermath.

5. Security in Depth

No one solution will limit all of the risks applicable to a given enterprise, group, or user. Additionally, no solution or combination of solutions will do more than limit the risk. The first step in determining what risk-reduction steps will be taken is for enterprises, groups, and users to undertake a risk analysis and determine what vulnerabilities exist. Subsequently, they must determine how much they wish to invest and reduce potentially available network functions to reduce those risks and implement only solutions that fit within their requirements.

The U.S. Department of Defense has required its various agencies and components to implement a process called DIACAP (for DOD Information Assurance Certification and Accreditation Process), which provides a way of analyzing the security needs of an organization operating networks and computers and assessing a wide range of risks and mitigations. While the DIACAP process may be overkill for the average user and organization, it is instructive to look at as an indication of the wide range and depth of security issues that may need to be considered.

6. Managing Resources

With the wide range of services and providers and geographically dispersed components, today's network presents many challenges to the administrator who wants to provide a high level of service to customers. The technology known as network management can offer many functions that can help that administrator improve service levels.

The network management model used by the International Organization for Standardization (ISO) provides a structure on which to build service maintenance and improvements. The ISO structure includes five areas of network management:

· performance administration

· faults and management

· configuration management and change control

· accounting

· security administration

Network management protocols permit devices to exchange data with network management workstations or hosts that can be used to facilitate these five areas. The network management entity uses this data to establish a database to track activity and changes over time, make some revisions to network service automatically, and help alert administrators to situations requiring attention.