Authentication and Encryption in EPON
|
|
|
- Ursula Joseph
- 7 years ago
- Views:
Transcription
1 Authentication and Encryption in EPON Ken Murakami: Mitsubishi Electric Supporters Yukio Fujimoto: NTT Osamu Yoshihara: NTT July 2002 IEEE802.3ah EFM Task Force 1
2 Purpose of Authentication Users without contract can be connected on PON section by Auto Discovery. CO apartment Pre establishment of optical fiber in newly-built apartment CO Leaving of optical fiber at the moving Authentication on PON section is necessary! out in July 2002 IEEE802.3ah EFM Task Force 2
3 Authentication to whom? Discovered ONU contains one or more logical links. User makes a contract with service provider for each logical link. Authentication information (identity and password) are assigned to each logical link. ONU Logical Link Physical Link Auto Discovery OLT Logical Link level authentication is suitable. Not for ONU. ONU Logical Link OLT Behaviors Users with contract can be connected toward SNI with the guarantee of bandwidth. Users without contract should be assigned bandwidth for authentication. Users without contract should not be connected to SNI. ONU Physical Link Authentication Logical Link Physical Link OLT July 2002 IEEE802.3ah EFM Task Force 3
4 Authentication Protocol 802.1x EAPOL Extensible Authentication Protocol encapsulation over LANs EAP encapsulation with Ethernet MACs can be applied to EPON easily. PA DA SA Type EAP packet (PAD) FCS LLID indicates the logical link that will be authenticated. LLID 88-8E Packet body RFC2284 Protocol version Packet type Packet body length Code Identifier Length Data 1B 1B 2B 1B 1B 2B Allocation of functionality Authenticator OLT Supplicant ONU Authentication Server Implementation matter External equipment Inside OLT Two types of message flow Supplicant initiated Authenticator initiated Type 1B Type data July 2002 IEEE802.3ah EFM Task Force 4
5 Message flow (1) Supplicant initiated Only GATE for authentication same as normal GATE should be periodically sent. Authentication information (ID/Password) ONU (Supplicant) GATE EAPOL-Start EAP-Request/Identity GATE EAP-Response/Identity OLT (Authenticator) Authentication Server EAP-Request GATE EAP-Response EAP-Success Verification July 2002 IEEE802.3ah EFM Task Force 5
6 Message flow (2) Authenticator initiated In addition to GATE, EAP-Request/Identity should be periodically sent. Authentication information (ID/Password) ONU (Supplicant) EAP-Request/Identity GATE EAP-Response/Identity OLT (Authenticator) Authentication Server EAP-Request GATE EAP-Response EAP-Success Verification July 2002 IEEE802.3ah EFM Task Force 6
7 Authentication mechanism Password based authentication EPON is wired and closed network. no man in the middle attack Authentication information is transferred in the upstream. difficult to eavesdrop Same intensity of authentication as P2P or dial-up is enough! Long length of password such as WLAN is not necessary. Exchange of initial master key 802.1x can exchange initial master key for encryption using EAP-TLS (RFC2716) as an example. July 2002 IEEE802.3ah EFM Task Force 7
8 ID and Password Authentication information (Identity, Password) Pre-registered in Authentication Server How to give authentication information to ONU is implementation matter. Memory card on ONU Input from user.etc Authentication Protocol on PON section is independent of the location of authentication server and the method how to give authentication information to ONU. Input from user ONU (Supplicant) OLT (Authenticator) 802.1x (EAPOL) Authentication Server Memory card Scope of standard July 2002 IEEE802.3ah EFM Task Force 8
9 Purpose of Encryption Downstream encryption Prevent eavesdropping of OAM traffic, MPCP messages and user frames User frames are encrypted by Higher layer protocol. But it is not enough. Eavesdropping of GATE enables users to analyze the traffic of other users. Encryption on PON section is necessary! July 2002 IEEE802.3ah EFM Task Force 9
10 Encryption to whom? Two candidates Encryption to each logical link Common algorithm Individual keys for each logical link (P2P) Individual keys for each group (multicast) No encryption for broadcast Encryption for authenticated logical link Encryption to each ONU Common algorithm Individual key for each ONU (P2P). Individual keys for each group (multicast) No encryption for broadcast Maintenance of relationship between LLIDs and physical ONUs Encryption for discovered ONU Our recommendation = Encryption to each logical link MPCP is performed per logical link. Grant assignment GATE is issued to a certain LLID. Bridge Logical link corresponds to bridging port. MPCP does not care physical ONU at all. ONU Key Key Key ONU Key Key Logical link P2P P2P multicast broadcast Logical link P2P P2P multicast broadcast July 2002 IEEE802.3ah EFM Task Force 10
11 Encryption algorithm Encryption algorithm TBD Packet length should be maintained. No overhead due to encryption July 2002 IEEE802.3ah EFM Task Force 11
12 Encryption layering Emulation layer has optional encrypt and decrypt function for each logical link separately. Key update indication (e.g., encryption flag, key index) is included in preamble. Encryption range MAC frame (DA FCS) Preamble including LLID and key update indication should not be encrypted. All of frames including MPCP messages and OAM frames on authenticated logical link are encrypted. MAC Control MAC MAC Control MAC Enc Enc Enc Emulation sub-layer RS GMII PCS+PMA+PMD MAC Control MAC July 2002 IEEE802.3ah EFM Task Force 12
13 Creation of Encryption key (initialization) Process Initial master key is exchanged in the authentication. Master session key is derived from master key. (802.11i Annex J) Transient session key is derived from master session key. (802.11i Annex I) Encryption key is truncated from transient session key. July 2002 IEEE802.3ah EFM Task Force 13
14 Encryption key update procedure (Re-keying) Encryption key can be updated periodically. The interval of update depends on algorithm x based procedure EAPOL-Key frame Key Descriptor for the selected encryption algorithm should be specified in 802.1x. MAC Control layer is responsible for the procedure. Key creation process Master session key is derived from the current transient key and from the nonce contained in EAPOL-Key frame. Transient session key and encryption key are derived using the same process as in the initialization. July 2002 IEEE802.3ah EFM Task Force 14
15 802.1x based procedure Message EAPOL-Key frame (ONUOLT) Decryption using new key ONU GATE 802.1x EAPOL-Key {Key Descriptor} User data OLT Encryption using new key Problem Loss of frame Disagreement of key between OLT and ONU Decryption using new key ONU GATE 802.1x EAPOL-Key {Key Descriptor} User data OLT Encryption using old key July 2002 IEEE802.3ah EFM Task Force 15
16 Frame by frame indication of encryption Indication of encryption is necessary frame by frame. Encryption flag Encrypted or not encrypted Key index Current used key Significant when encryption flag is set to 1 Others Use of preamble July 2002 IEEE802.3ah EFM Task Force 16
17 Usage of flag and key index Encryption function stores 2 keys for smooth transition. Current used key is reported in preamble. ONU Current key#0 Encrypted with key#0 Store key#1 Encrypted with key#0 Encrypted with key#1 Discard key#0 & Store key #2 Encrypted with key#1 Encrypted with key#2 Preamble {flag=1, key=#0}+user data 802.1x EAPOL-Key {new key#1} Preamble {flag=1, key=#0}+user data Preamble {flag=1, key=#1}+user data 802.1x EAPOL-Key {new key#2} Preamble {flag=1, key=#1}+user data Preamble {flag=1, key=#2}+user data OLT Process delay for new key Process delay for new key July 2002 IEEE802.3ah EFM Task Force 17
18 Conclusion Authentication 802.1x based authentication protocol is applied on EPON. Logical link level authentication is supported. Initial master key for encryption is exchanged in the authentication. Encryption All of frames including OAM frames and MPCP messages are encrypted in the downstream. Logical link level encryption is applied. Encryption is performed on the authenticated logical link. Emulation layer has encryption and decryption function. Entire MAC frame (DA~FCS) is encrypted. MAC control layer is responsible for encryption key update procedure. Creation of encryption key and re-keying based on 802.1x and i Encryption flag and key index are indicated in preamble frame by frame. July 2002 IEEE802.3ah EFM Task Force 18
19 Issues Authentication Exchange of initial master key for encryption EAP-TLS EAP-SIM Encryption Message authentication (upstream encryption) Encryption algorithm Key exchanging for multicast July 2002 IEEE802.3ah EFM Task Force 19
20 Appendix 1 Authentication mechanism PAP (Password Authentication Protocol: RFC1334) Server maintains encrypted password in the password file. Password from user is not encrypted. Server encrypts password from user and verifies it with encrypted password maintained in the password file. ID Password Encryption Server Password file Encrypted password Encrypted password Verification July 2002 IEEE802.3ah EFM Task Force 20
21 Appendix 1 Authentication mechanism CHAP (Challenge Handshake Authentication Protocol) Server maintains password in the password file. Server creates challenge value and gives it to user. Password from user is hashed with the challenge value given from server. Server hashes password in the password file with the challenge value sent to user and verifies it with hashed password from user. ID Server Challenge value Challenge value Password file Hashing Password Hashed password Hashing Password Verification Encrypted password July 2002 IEEE802.3ah EFM Task Force 21
22 Appendix 1 Authentication mechanism OTP (One Time Password) Time synchronous Dedicated hardware (ID card) is necessary. Displayed number on the ID card is periodically updated at a fixed interval. Passcode on the server is also periodically updated at a fixed interval. The timing of password update and that of passcode update are synchronous. Password from user consists of PIN code and displayed number. Server creates password from PIN code and passcode at the receipt of password from user, and verifies it with password from user. ID card ID Password PIN + displayed number Synchronous update Password Server Passcode PIN + Passcode Passcode is updated periodically. Displayed number is updated periodically. Verification Password July 2002 IEEE802.3ah EFM Task Force 22
IEEE 802.1X Overview. Port Based Network Access Control
IEEE 802.1X Overview Port Based Network Access Control 802.1X Motivation and History Increased use of 802 LANs in public and semi-public places Desire to provide a mechanism to associate end-user identity
EPON Technology White Paper
EPON Technology White Paper Content 1.Overview...4 2.Network Architecture...4 3.Principles...5 4.Architecture...6 5.Key Technologies...8 5.1 ONU s Autodiscovery...8 5.2 Synchronization and Ranging...9
Certficate Extensions and Attributes Supporting Authentication in PPP and Wireless LAN. Daniel Schwarz
Certficate Extensions and Attributes Supporting Authentication in PPP and Wireless LAN Daniel Schwarz Overview: 1. Introduction I. PKIX 2. Basics I. PPP II. EAP III. 802.1x IV. X.509 certificate extensions
Chapter 10 Security Protocols of the Data Link Layer
Chapter 10 Security Protocols of the Data Link Layer IEEE 802.1x Point-to-Point Protocol (PPP) Point-to-Point Tunneling Protocol (PPTP) [NetSec], WS 2006/2007 10.1 Scope of Link Layer Security Protocols
IEEE 802.1X For Wireless LANs
IEEE 802.1X For Wireless LANs John Roese, Ravi Nalmati, Cabletron Albert Young, 3Com Carl Temme, Bill McFarland, T-Span David Halasz, Aironet Paul Congdon, HP Andrew Smith, Extreme Networks Slide 1 Outline
Lecture 3. WPA and 802.11i
Lecture 3 WPA and 802.11i Lecture 3 WPA and 802.11i 1. Basic principles of 802.11i and WPA 2. IEEE 802.1X 3. Extensible Authentication Protocol 4. RADIUS 5. Efficient Handover Authentication 1 Lecture
Executive Summary. This white paper includes the following sections: A.What Does 802.1x Do? B. An Overview of the 802.1x Standard
Allied Telesis White Paper 802.1x White Paper Executive Summary Security and flexibility are often seen as mutually exclusive requirements in a network, yet both are equally important. Security is crucial
White paper. Testing for Wi-Fi Protected Access (WPA) in WLAN Access Points. http://www.veryxtech.com
White paper Testing for Wi-Fi Protected Access (WPA) in WLAN Access Points http://www.veryxtech.com White Paper Abstract Background The vulnerabilities spotted in the Wired Equivalent Privacy (WEP) algorithm
WLAN Access Security Technical White Paper. Issue 02. Date 2012-09-24 HUAWEI TECHNOLOGIES CO., LTD.
WLAN Access Security Technical White Paper Issue 02 Date 2012-09-24 HUAWEI TECHNOLOGIES CO., LTD. . 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by
Security for 802 Access Networks: A Problem Statement
Security for 802 Access Networks: A Problem Statement Norman Finn, Cisco Systems Session Number 1 Why bother with Link Layer security? Why not just use IPSEC? There are many protocols that are not securable
GPON - EPON Comparison
White Paper GPON - EPON Comparison CommScope Solutions Marketing October 2013 Contents Introduction 3 Protocol fundamentals 4 Framing/service adaption 4 Basic operation 5 Service hierarchy 7 Bandwidth
White Paper Testing Ethernet Passive Optical Networks
White Paper Testing Ethernet Passive Optical Networks This white paper discusses the different types of Passive Optical Networks with a particular focus on the technology and testing of Ethernet Passive
What information will you find in this document?
AlliedWare TM OS How To Configure Basic 802.1x Port Authentication Introduction This How To Note is a guide to 802.1x and Port Authentication. It outlines the implementation of the IEEE 802.1x standard
802.11b Wireless LAN Authentication, Encryption, and Security
802.11b Wireless LAN Authentication, Encryption, and Security Young Kim ELEN 6951 1. Abstract With the rapid growth of wireless local area network, security has been the number one concern in this arena
Authentication in WLAN
Authentication in WLAN Flaws in WEP (Wired Equivalent Privacy) Wi-Fi Protected Access (WPA) Based on draft 3 of the IEEE 802.11i. Provides stronger data encryption and user authentication (largely missing
Corso di Network Security a.a. 2012/2013. Collection of some exercises on the second part of the course
University of Parma Department of Information Engineering Corso di Network Security a.a. 2012/2013 Collection of some exercises on the second part of the course 1) Specify the name of the CHAP messages
Gigabit Ethernet MAC. (1000 Mbps Ethernet MAC core with FIFO interface) PRODUCT BRIEF
Gigabit Ethernet MAC (1000 Mbps Ethernet MAC core with FIFO interface) PRODUCT BRIEF 1. INTRODUCTION This document serves as a product info for the Gigabit Ethernet MAC from Hitek Systems. The core supports
802.1X Client Software
802.1X Client Software REV1.0.0 1910011339 COPYRIGHT & TRADEMARKS Specifications are subject to change without notice. is a registered trademark of TP-LINK TECHNOLOGIES CO., LTD. Other brands and product
Using IEEE 802.1x to Enhance Network Security
Using IEEE 802.1x to Enhance Network Security Table of Contents Introduction...2 Terms and Technology...2 Understanding 802.1x...3 Introduction...3 802.1x Authentication Process...3 Before Authentication...3
Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer
Other VPNs TLS/SSL, PPTP, L2TP Advanced Computer Networks SS2005 Jürgen Häuselhofer Overview Introduction to VPNs Why using VPNs What are VPNs VPN technologies... TLS/SSL Layer 2 VPNs (PPTP, L2TP, L2TP/IPSec)
The 802.1x specification
The 802.1x specification Fulvio Risso Politecnico di Torino Based on an existing presentation of Piero Nicoletti 1 IEEE 802.1x Port-Based Network Access Control Use physical access characteristics of IEEE
WLAN Security. Giwhan Cho ghcho@dcs.chonbuk.ac.kr. Distributed/Mobile Computing System Lab. Chonbuk National University
WLAN Security Giwhan Cho ghcho@dcs.chonbuk.ac.kr Distributed/Mobile Computing System Lab. Chonbuk National University Content WLAN security overview 802.11i WLAN security components pre-rsn (Robust Security
Modification Comment for GATE Message
Modification Comment for GATE Message LEE Ho-Sook ETRI Yoo Tae-Whan ETRI Son Kyu-Ho KAIST Jeong Song KAIST PON Team Motivation Yes, current GATE & REPORT message supports well DBA. It supports 8 classes
How To Secure Your Network With 802.1X (Ipo) On A Pc Or Mac Or Macbook Or Ipo On A Microsoft Mac Or Ipow On A Network With A Password Protected By A Keyed Key (Ipow)
Wireless LAN Security with 802.1x, EAP-TLS, and PEAP Steve Riley Senior Consultant MCS Trustworthy Computing Services So what s the problem? WEP is a euphemism Wired Equivalent Privacy Actually, it s a
Enhanced Intranet Management in a DHCP-enabled Environment
Enhanced Intranet Management in a DHCP-enabled Environment Jenq-Haur Wang and Tzao-Lin Lee Department of Computer Science and Information Engineering, National Taiwan University, Taipei, Taiwan. E-mail:
Wireless security. Any station within range of the RF receives data Two security mechanism
802.11 Security Wireless security Any station within range of the RF receives data Two security mechanism A means to decide who or what can use a WLAN authentication A means to provide privacy for the
Network Security. Chapter 10 Security Protocols of the Data Link Layer
Network Security Chapter 10 Security Protocols of the Data Link Layer! IEEE 802.1x! Point-to-Point Protocol (PPP)! Point-to-Point Tunneling Protocol (PPTP)! Layer 2 Tunneling Protocol (L2TP)! Virtual Private
802.3ah Operations Management: Requirements From A Diverse Services Provider
802.3ah Operations Management: Requirements From A Diverse Services Provider Roy Bynum Global Access Technology Development WorldCom 1 Data Transmission Service Provider OAM Need to support wide diversity
Network Authentication - 802.1X Secure the Edge of the Network - Technical White Paper
Bosch Security Systems Video Systems Network Authentication - 802.1X Secure the Edge of the Network - Technical White Paper 4 July 2016 Secure the edge of the network Security devices are mostly located
An Architectural Framework for Providing WLAN Roaming
An Architectural Framework for Providing WLAN Roaming D.Vassis, G.Kormentzas Dept. of Information and Communication Systems Engineering University of the Aegean GR-83200, Karlovassi, GREECE emails:{divas;
A Dynamic Extensible Authentication Protocol for Device Authentication in Transport Layer Raghavendra.K 1, G. Raghu 2, Sumith N 2
A Dynamic Extensible Authentication Protocol for Device Authentication in Transport Layer Raghavendra.K 1, G. Raghu 2, Sumith N 2 1 Dept of CSE, P.A.College of Engineering 2 Dept of CSE, Srnivas institute
CS 356 Lecture 29 Wireless Security. Spring 2013
CS 356 Lecture 29 Wireless Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter
Configure WorkGroup Bridge on the WAP131 Access Point
Article ID: 5036 Configure WorkGroup Bridge on the WAP131 Access Point Objective The Workgroup Bridge feature enables the Wireless Access Point (WAP) to bridge traffic between a remote client and the wireless
SLIP and PPP. Gursharan Singh Tatla. mailme@gursharansingh.in www.eazynotes.com. 1 www.eazynotes.com
SLIP and PPP Gursharan Singh Tatla mailme@gursharansingh.in 1 Data Link Layer in Internet We know that Internet consists of individual systems that are connected to each other. Basically, it is wide are
How To Authenticate With Port Based Authentication
Chapter 2, Port-Based Authentication Concepts Author: Jim Geier Principal Consultant, Wireless-Nets, Ltd. Email: jimgeier@wireless-nets.com This chapter is a sample from the book Implementing 802.1x Security
WiFi Security: WEP, WPA, and WPA2
WiFi Security: WEP, WPA, and WPA2 - security requirements in wireless networks - WiFi primer - WEP and its flaws - 802.11i - WPA and WPA2 (RSN) Why security is more of a concern in wireless? no inherent
Data Link Protocols. TCP/IP Suite and OSI Reference Model
Data Link Protocols Relates to Lab. This module covers data link layer issues, such as local area networks (LANs) and point-to-point links, Ethernet, and the Point-to-Point Protocol (PPP). 1 TCP/IP Suite
Application Note: Onsight Device VPN Configuration V1.1
Application Note: Onsight Device VPN Configuration V1.1 Table of Contents OVERVIEW 2 1 SUPPORTED VPN TYPES 2 1.1 OD VPN CLIENT 2 1.2 SUPPORTED PROTOCOLS AND CONFIGURATION 2 2 OD VPN CONFIGURATION 2 2.1
Operator s Requirements for G-PON:
Operator s Requirements for G-PON: Summary Of Work In ITU-T SG15/Q2 GSR Brian Ford BellSouth BellSouth, British Telecom, Deutsche Telekom, France Telecom, NTT, Telecom Italia and SBC Introduction This
Lab 7. Answer. Figure 1
Lab 7 1. For each of the first 8 Ethernet frames, specify the source of the frame (client or server), determine the number of SSL records that are included in the frame, and list the SSL record types that
WLAN 802.11w Technology
Technical white paper WLAN 80.w Technology Table of contents Overview... Technical background... Benefits... 80.w technology implementation... Management Frame Protection negotiation... Protected management
SIMPLE AUTHENTICATION AND SECURITY LAYER INCORPORATING EXTENSIBLE AUTHENTICATION PROTOCOL MYUNG-SUN KIM. B.S., University of New Hampshire, 2005
SIMPLE AUTHENTICATION AND SECURITY LAYER INCORPORATING EXTENSIBLE AUTHENTICATION PROTOCOL BY MYUNG-SUN KIM B.S., University of New Hampshire, 2005 B.A., University of New Hampshire, 2005 THESIS Submitted
Guide to TCP/IP, Third Edition. Chapter 3: Data Link and Network Layer TCP/IP Protocols
Guide to TCP/IP, Third Edition Chapter 3: Data Link and Network Layer TCP/IP Protocols Objectives Understand the role that data link protocols, such as SLIP and PPP, play for TCP/IP Distinguish among various
VPN. Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu
VPN Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu What is VPN? A VPN (virtual private network) is a private data network that uses public telecommunicating infrastructure (Internet), maintaining
Configuring Wired 802.1x Authentication on Windows Server 2012
Configuring Wired 802.1x Authentication on Windows Server 2012 Johan Loos johan@accessdenied.be Version 1.0 Why 802.1x Authentication? The purpose of this document is to guide you through the procedure
EVOLUTION OF WIRELESS LAN SECURITY ARCHITECTURE TO IEEE 802.11i (WPA2)
EVOLUTION OF WIRELESS LAN SECURITY ARCHITECTURE TO IEEE 802.11i (WPA2) Moffat Mathews, Ray Hunt Department of Computer Science and Software Engineering, University of Canterbury, New Zealand {ray.hunt@canterbury.ac.nz}
Ajay Gummalla-July 2001
DOCSIS Overview Ajay Gummalla Ethernet in the First Mile Study Group July 2001 Ajay Gummalla-July 2001 1 HFC Plant Topology VIDEO combiner Fiber TX Fiber Fiber RX Tap CMTS Fiber RX Fiber Fiber TX 2way
2. What is the maximum value of each octet in an IP address? A. 128 B. 255 C. 256 D. None of the above
1. How many bits are in an IP address? A. 16 B. 32 C. 64 2. What is the maximum value of each octet in an IP address? A. 128 B. 255 C. 256 3. The network number plays what part in an IP address? A. It
Wireless Technology Seminar
Wireless Technology Seminar Introduction Adam Worthington Network Consultant Adam.Worthington@euroele.com Wireless LAN Why? Flexible network access for your users? Guest internet access? VoWIP? RFID? Available
Chapter 2 Wireless Networking Basics
Chapter 2 Wireless Networking Basics Wireless Networking Overview Some NETGEAR products conform to the Institute of Electrical and Electronics Engineers (IEEE) 802.11g standard for wireless LANs (WLANs).
Authentication and Security in IP based Multi Hop Networks
7TH WWRF MEETING IN EINDHOVEN, THE NETHERLANDS 3RD - 4TH DECEMBER 2002 1 Authentication and Security in IP based Multi Hop Networks Frank Fitzek, Andreas Köpsel, Patrick Seeling Abstract Network security
CCT vs. CCENT Skill Set Comparison
Operation of IP Data Networks Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges and Hubs Select the components required to meet a given network specification
ACC-232 2002, Cisco Systems, Inc. All rights reserved.
1 2 Securing 802.11 Wireless Networks Session 3 Session Information Basic understanding of components of 802.11 networks Please save questions until the end 4 Agenda Drivers for Wireless Security Wireless
NETWORK ACCESS CONTROL AND CLOUD SECURITY. Tran Song Dat Phuc SeoulTech 2015
NETWORK ACCESS CONTROL AND CLOUD SECURITY Tran Song Dat Phuc SeoulTech 2015 Table of Contents Network Access Control (NAC) Network Access Enforcement Methods Extensible Authentication Protocol IEEE 802.1X
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
7.1. Remote Access Connection
7.1. Remote Access Connection When a client uses a dial up connection, it connects to the remote access server across the telephone system. Windows client and server operating systems use the Point to
Wireless LANs and Privacy. Ido Dubrawsky Network Security Engineer Cisco Secure Consulting Services Cisco Systems, Inc. And
Wireless LANs and Privacy Ido Dubrawsky Network Security Engineer Cisco Secure Consulting Services Cisco Systems, Inc. And Lance Hayden Business Development Manager Cisco Secure Consulting Services Cisco
10 Gigabit Ethernet MAC Core for Altera CPLDs. 1 Introduction. Product Brief Version 1.4 - February 2002
1 Introduction Initially, network managers use 10 Gigabit Ethernet to provide high-speed, local backbone interconnection between large-capacity switches. 10 Gigabit Ethernet enables Internet Service Providers
Tech Note Cisco IOS SNMP Traps Supported and How to Conf
Tech Note Cisco IOS SNMP Traps Supported and How to Conf Table of Contents Cisco IOS SNMP Traps Supported and How to Configure Them...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1
CHAPTER 10 LAN REDUNDANCY. Scaling Networks
CHAPTER 10 LAN REDUNDANCY Scaling Networks CHAPTER 10 10.0 Introduction 10.1 Spanning Tree Concepts 10.2 Varieties of Spanning Tree Protocols 10.3 Spanning Tree Configuration 10.4 First-Hop Redundancy
Ethernet A Survey on its Fields of Application
Ethernet A Survey on its Fields of Application Fachtagung ITG FA 5.2 "Zukunft der Netze" Jörg Sommer et al. joerg.sommer@ikr.uni-stuttgart.de 7. Oktober 2010 Universität Stuttgart Institut für Kommunikationsnetze
Ethernet Passive Optical Networks EPON
Ethernet Passive Optical Networks EPON IEEE 802.3 Ethernet in the First Mile Study Group January 8-9, 2001, Irvine, CA Gerry Pesavento Alloptic, Inc. Tel 925-245-7647 Email gerry.pesavento@alloptic.com
Chapter 4: Security of the architecture, and lower layer security (network security) 1
Chapter 4: Security of the architecture, and lower layer security (network security) 1 Outline Security of the architecture Access control Lower layer security Data link layer VPN access Wireless access
CCNA R&S: Introduction to Networks. Chapter 5: Ethernet
CCNA R&S: Introduction to Networks Chapter 5: Ethernet 5.0.1.1 Introduction The OSI physical layer provides the means to transport the bits that make up a data link layer frame across the network media.
EAP-WAI Authentication Protocol
EAP-WAI Authentication Protocol draft-richard-emu-wai-00 Richard 2009-07-26 Stockholm, IETF 75th Preface WAPI is a WLAN security protocol and brought forward By a Standard Group in China. It was invited
UNIVERZITA KOMENSKÉHO V BRATISLAVE FAKULTA MATEMATIKY, FYZIKY A INFORMATIKY PRÍPRAVA ŠTÚDIA MATEMATIKY A INFORMATIKY NA FMFI UK V ANGLICKOM JAZYKU
UNIVERZITA KOMENSKÉHO V BRATISLAVE FAKULTA MATEMATIKY, FYZIKY A INFORMATIKY PRÍPRAVA ŠTÚDIA MATEMATIKY A INFORMATIKY NA FMFI UK V ANGLICKOM JAZYKU ITMS: 26140230008 DOPYTOVO ORIENTOVANÝ PROJEKT Moderné
freeradius A High Performance, Open Source, Pluggable, Scalable (but somewhat complex) RADIUS Server Aurélien Geron, Wifirst, January 7th 2011
freeradius A High Performance, Open Source, Pluggable, Scalable (but somewhat complex) RADIUS Server Aurélien Geron, Wifirst, January 7th 2011 freeradius is... Multiple protocoles : RADIUS, EAP... An Open-Source
TLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
An MPLS-Based Micro-mobility Solution
An MPLS-Based Micro-mobility Solution IEEE-802.21-Based Control Plane Rajendra Persaud 1, Ralf Wienzek 1, Gerald Berghoff 2, and Ralf Schanko 2 1 Chair of Computer Science 4, RWTH Aachen University, Germany
OAM Operations Administration and Maintenance
OAM Operations Administration and Maintenance IERU Communications Ltd OAM Rev. A Page 1 of 9 Operations Administration and Maintenance 1. Overview This paper describes the Ethernet and Multi-Protocol Label
OPTICAL NETWORKS. Optical Access Networks. A. Gençata İTÜ, Dept. Computer Engineering 2005
OPTICAL NETWORKS Optical Access Networks A. Gençata İTÜ, Dept. Computer Engineering 2005 Outline Broadband access network architectures employing Passive (PONs). The potential of PONs to deliver high bandwidths
The following chart provides the breakdown of exam as to the weight of each section of the exam.
Introduction The CWSP-205 exam, covering the 2015 objectives, will certify that the successful candidate understands the security weaknesses inherent in WLANs, the solutions available to address those
Evaluation of EAP Authentication Methods in Wired and Wireless Networks
Master Thesis Electrical Engineering October 2012 Evaluation of EAP Authentication Methods in Wired and Wireless Networks Tirumala Rao Kothaluru Mohamed Youshah Shameel Mecca School of Computing Blekinge
Security Design. thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/
Security Design thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/ Content Security Design Analysing Design Requirements Resource Separation a Security Zones VLANs Tuning Load Balancing
EAP Authentication Protocols for WLANs
C H A P T E R 7 EAP Authentication Protocols for WLANs The second in the WLAN authentication trilogy of chapters, this chapter examines the various authentication protocols such as the Extensible Authentication
10/100/1000 Ethernet MAC with Protocol Acceleration MAC-NET Core
1 Introduction The implements, in conjunction with a triple speed 10/100/1000 MAC, Layer 3 network acceleration functions, which are designed to accelerate the processing of various common networking protocols
Extensible Authentication Protocol Transport Layer Security Deployment Guide for Wireless LAN Networks
White Paper Extensible Authentication Protocol Transport Layer Security Deployment Guide for Wireless LAN Networks 1 Scope This document discusses the Extensible Authentication Protocol Transport Layer
Network Access Control and Cloud Security
Network Access Control and Cloud Security Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Module 6, Assignment 5
SusanFerdon,EDTECH552SP11 Module 6, Assignment 5 5.1 Multiple Choice Questions 1. Which of the following is unlicensed band, which can be used by WLAN s? A. 2.4 GHz band B. 2.4 MHz band C. 5 GHz band D.
Bit Chat: A Peer-to-Peer Instant Messenger
Bit Chat: A Peer-to-Peer Instant Messenger Shreyas Zare shreyas@technitium.com https://technitium.com December 20, 2015 Abstract. Bit Chat is a peer-to-peer instant messaging concept, allowing one-to-one
JOB READY ASSESSMENT BLUEPRINT COMPUTER NETWORKING FUNDAMENTALS - PILOT. Test Code: 4514 Version: 01
JOB READY ASSESSMENT BLUEPRINT COMPUTER NETWORKING FUNDAMENTALS - PILOT Test Code: 4514 Version: 01 Specific Competencies and Skills Tested in this Assessment: PC Principles Identify physical and equipment
IP Networking. Overview. Networks Impact Daily Life. IP Networking - Part 1. How Networks Impact Daily Life. How Networks Impact Daily Life
Overview Dipl.-Ing. Peter Schrotter Institute of Communication Networks and Satellite Communications Graz University of Technology, Austria Fundamentals of Communicating over the Network Application Layer
Wireless Encryption Protection
Wireless Encryption Protection We re going to jump around a little here and go to something that I really find interesting, how do you secure yourself when you connect to a router. Now first and foremost
VXLAN: Scaling Data Center Capacity. White Paper
VXLAN: Scaling Data Center Capacity White Paper Virtual Extensible LAN (VXLAN) Overview This document provides an overview of how VXLAN works. It also provides criteria to help determine when and where
GPON 984.3. Section 12-14 Reporter: 王 依 盈 94.10.26
GPON 984.3 Section 12-14 Reporter: 王 依 盈 94.10.26 Outline Security Forward Error Correction OMCI Transport Mechanism Security Basic Threat Model Encryption System Key exchange and switch-over Forward Error
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.
Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols
Security Technology White Paper
Security Technology White Paper Issue 01 Date 2012-10-30 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without
Security in IEEE 802.11 WLANs
Security in IEEE 802.11 WLANs 1 IEEE 802.11 Architecture Extended Service Set (ESS) Distribution System LAN Segment AP 3 AP 1 AP 2 MS MS Basic Service Set (BSS) Courtesy: Prashant Krishnamurthy, Univ Pittsburgh
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 8 Authentication
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 8 Authentication Objectives Define authentication Describe the different types of authentication credentials List and explain the
Ethernet. Ethernet. Network Devices
Ethernet Babak Kia Adjunct Professor Boston University College of Engineering ENG SC757 - Advanced Microprocessor Design Ethernet Ethernet is a term used to refer to a diverse set of frame based networking
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Controller Management
Controller Management - Setup & Provisioning - 1 PRONTO SERVICE CONTROLLER (PN-CPP-A-1422) 2 PSC Key Features Fully interoperable with IEEE802.11b/g compliant products External AP support and management
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
Enabling Multiple Wireless Networks on RV320 VPN Router, WAP321 Wireless-N Access Point, and Sx300 Series Switches
print email Article ID: 4941 Enabling Multiple Wireless Networks on RV320 VPN Router, WAP321 Wireless-N Access Point, and Sx300 Series Switches Objective In an ever-changing business environment, your
HIPAA Security Considerations for Broadband Fixed Wireless Access Systems White Paper
HIPAA Security Considerations for Broadband Fixed Wireless Access Systems White Paper Rev 1.0 HIPAA Security Considerations for Broadband Fixed Wireless Access Systems This white paper will investigate
Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication
Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication Requirements You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. To configure
Improvement in Maintenance and Operation of 10G-EPON System
FEATURED TOPIC Improvement in Maintenance and Operation of 10G-EPON System Hideyuki HIRAI*, Shingo SHIBA, Shinichi KOUYAMA, Yoshiyuki SHIMADA, Junichi MICHIMATA and Hiroshi MURATA FTTH (Fiber To The Home)
Cable Data Services DOCSIS Provisioning of EPON Specifications. DPoE Security and Certificate Specification
Cable Data Services DOCSIS Provisioning of EPON Specifications DPoE Security and Certificate Specification ISSUED Notice This DPoE specification is the result of a cooperative effort undertaken by certain
ERserver. iseries. Remote Access Services: PPP connections
ERserver iseries Remote Access Services: PPP connections ERserver iseries Remote Access Services: PPP connections Copyright International Business Machines Corporation 1998, 2002. All rights reserved.