Lecture 4b AAA protocols (Authentication Authorization Accounting)
|
|
|
- Thomas Clyde Wilkerson
- 8 years ago
- Views:
Transcription
1 Lecture 4b AAA protocols (Authentication Authorization Accounting) Network security ( / ) Lecturers: Aiko Pras Pieter-Tjerk de Boer Anna Sperotto Ramin Sadre Georgios Karagiannis
2 Lecture material to be found via Blackboard: Course Information => Course material that can be downloaded: => radius_diameter.txt file can also be downloaded via: radius_diameter.txt includes text copied from RFC2865, RFC2866, RFC3588 AAA protocols - Lecture 4b 2
3 Outline Goal of this lecture What s AAA? Basic operation RADIUS (Remote Authentication Dial In User Service) Basic operation DIAMETER Main differences DIAMETER vs. RADIUS Summary & References AAA protocols - Lecture 4b 3
4 Goal of this lecture understanding what is the AAA concept and which main AAA protocols are used and how they are used AAA protocols - Lecture 4b 4
5 Outline Goal of this lecture What s AAA? Basic operation RADIUS Basic operation DIAMETER Main differences DIAMETER vs. RADIUS Summary & References AAA protocols - Lecture 4b 5
6 What s AAA Authentication, authorization and accounting processes are needed when user tries to access and use Internet Authentication: act of verifying identity of entity Authorization: act of determining whether requesting entity is allowed access to a resource Accounting: act of collecting info on resource usage for the purpose of capacity planning, auditing, billing or cost allocation Concept standardized by IETF, e.g.: Generic AAA architecture (RFC2903) AAA Authorization Examples (RFC2905) AAA Authorization Framework (RFC2904) Example use: AAA can be used in combination with IEEE 802.1x to enhance WLAN authentication & authorization AAA protocols - Lecture 4b 6
7 What s AAA (example scenario) AAA client AAA server Authentication Authorization AAA client AAA protocol Accounting Modem Modem pool (NAS) AAA protocol proxy AAA protocol AAA data AAA data AAA protocol: supports AAA communication between AAA client and AAA server(s): TACACS (RFC1492) RADIUS (RFC2865) DIAMETER (RFC3588) AAA protocols - Lecture 4b 7
8 Outline Goal of this lecture What s AAA? Basic operation RADIUS Basic operation DIAMETER Main differences DIAMETER vs. RADIUS Summary & References AAA protocols - Lecture 4b 8
9 Basic operation RADIUS RADIUS: AAA protocol used to carry AAA information between AAA client (e.g., Network Access Server) and a shared AAA server AAA protocols - Lecture 4b 9
10 Basic operation RADIUS (key features) Client/Server Model Client: NAS (Network Access Server): generates AAA request Server: RADIUS server handles request (operates also as proxy) Network Security: transactions authenticated using shared secret key, manually distributed, between client/server any user passwords, hidden using MD5 (RFC1321) + other End-to-end security (for non proxy RADIUS), but cannot be guaranteed Flexible Authentication Mechanisms, e.g.: PPP CHAP (Challenge Handshake Authentication Protocol), EAP (Extensible Authentication Protocol) Extensible protocol: AAA attribute information carried in Attribute- Length-Value; new attribute values added without disturbing existing implementations Uses UDP as transport protocol AAA protocols - Lecture 4b 10
11 Basic operation RADIUS (document architecture) (IPv4) base specification defining base protocol on authentication and authorization Accounting application for support of accounting RADIUS extensions for AAA application extensions EAP application for support of various authentication methods RADIUS operation when run over IPv6 Chargeable user identity attribute used in case of real time accounting RADIUS usage guidelines for IEEE 802.1x Accounting (RFC2866) RADIUS extensions (RFC2869) EAP (RFC3579) RADIUS and IPv6 (RFC3162) Chargeable User Identity (RFC4372) IEEE802.1x usage guidelines (RFC3580) RADIUS Base Protocol: IPv4 based (RFC2865) Transport (UDP) AAA protocols - Lecture 4b 11
12 Basic operation RADIUS (message types) Codes and message types: 1 Access-Request 2 Access-Accept 3 Access-Reject 4 Accounting-Request 5 Accounting-Response 11 Access-Challenge 12 Status-Server (experimental) 13 Status-Client (experimental) 255 Reserved AAA protocols - Lecture 4b 12
13 Basic operation RADIUS (session establishment/termination) Same session used for authentication/authorization and accounting RADIUS client RADIUS Server Authen/Authz established Accounting established (e.g., User-Password Attribute) Authen/Authz Success Accounting stopped AAA protocols - Lecture 4b 13
14 Why is RADIUS using for transport UDP instead of TCP? Advantages If request to primary authentication server fails, secondary server must be queried: copy of request must be kept above transport layer retransmission timers still required, above transport layer Stateless nature of RADIUS protocol within communication network simplifies use of UDP: transport connection between client/server remains even if network failures are occurring Disadvantages Transport is not reliable (layer above transport has to take care of packet losses) TCP adapt to network congestion, while UDP does not AAA protocols - Lecture 4b 14
15 Outline Goal of this lecture What s AAA? Basic operation RADIUS Basic operation DIAMETER Main differences DIAMETER vs. RADIUS Summary & References AAA protocols - Lecture 4b 15
16 Basic operation DIAMETER DIAMETER: AAA protocol supports similar AAA features as RADIUS but with enhanced and additional capabilities AAA protocols - Lecture 4b 16
17 Basic operation DIAMETER (key features) Capabilities negotiation Carry AAA information in AVPs (Attribute Value Pairs) Error notification Extensibility, through addition of new commands and AVPs Basic services necessary for applications, such as handling of user sessions or accounting and session state maintenance Hop-by-hop security using IPSec (mandatory) and TLS (optional) authenticate each hop by shared secret key (distributed using automatic key distribution: e.g., IKE (Internet Key Exchange) HMAC-MD5-96 in [RFC2403] HMAC-SHA1-96 [RFC2404]) encrypt at each hop by shared secret (e.g., DES-CBC (Data Encryption Standard Cipher Block Chaining)) AAA protocols - Lecture 4b 17
![using IPSec (mandatory) and TLS (optional) authenticate each hop by shared secret key (distributed using automatic key distribution: e.g., IKE (Internet Key Exchange) HMAC-MD5-96 in [RFC2403] HMAC-SHA1-96 [RFC2404]) encrypt at each hop by shared secret (e.](/docs-images/53/11058336/images/page_17.jpg "g., DES-CBC (Data Encryption Standard Cipher Block Chaining)) AAA protocols - Lecture 4b 17")
18 Basic operation DIAMETER (key features) AVPs used by base Diameter protocol to support: Transporting user authentication information Transporting service specific authorization information Exchanging resource usage information may be used for accounting purposes, capacity planning, etc. Relaying and proxying of Diameter messages through server hierarchy. Transport: Diameter clients must support TCP or SCTP Diameter agents and servers must support TCP and SCTP Authentication/authorization session management may be independent of accounting session management: accounting information can be routed to different server than server used by authentication/authorization messages: Acct-Multi-Session-Id AVP in messages is used to correlate sessions AAA protocols - Lecture 4b 18
19 Basic operation DIAMETER (key features) DIAMETER base protocol provides minimum requirements needed: may be used by itself for accounting purposes only may be used with Diameter application, like NASREQ or MobileIPv4 may be extended for use in new applications with new commands or AVPs DIAMETER is peer-to-peer protocol any node can initiate a request DIAMETER client: node at edge of network performing access control generates Diameter messages for authentication, authorization and accounting of user DIAMETER agent: Relay, Proxy, Redirect, Translation agents does not authenticate and/or authorize messages locally DIAMETER server: node that performs authentication and/or authorization and accounting of user A node may act as agent for certain requests, while acting as server for others. AAA protocols - Lecture 4b 19
20 Basic operation DIAMETER (document architecture) base specification (IPv4 and IPv6) defining base protocol and accounting application (RFC 3588) Transport Profile document including failover mechanism and state machine (RFC 3539) NASREQ application for dial-in & terminal server applications (RFC 4005) EAP application for support of authentication methods (RFC4072) Credit Control application for real-time credit control (RFC 4006) SIP application provides AAA services to SIP entities (RFC 4740) MobileIPv4 application provides AAA support for Mobile IPv4 (RFC 4004) Accounting NASREQ (RFC4005) EAP (RFC4072) Credit Control (RFC4006) SIP (RFC4740) MobileIPv4 (RFC4004) DIAMETER Mobile IPv6 (RFC5447) DIAMETER Proxy Mobile IPv6 (RFC5779) Traffic classification QoS attributes (RFC5777) DIAMETER QoS (RFC5866) DIAMETER Base Protocol (RFC3588) Transport (TCP, SCTP) (RFC3539) AAA protocols - Lecture 4b 20
21 Basic operation DIAMETER (document architecture) MIPv6 bootstrapping using Diameter Network Access Server to home AAA server interface (RFC 5447) AAA interactions between proxy Mobile IPv6 entities and AAA server in proxy Mobile IPv6 domain (RFC 5779) DIAMETER AVPs for traffic classification and QoS support (RFC 5777) DIAMETER QoS application (RFC 5866) Accounting NASREQ (RFC4005) EAP (RFC4072) Credit Control (RFC4006) SIP (RFC4740) MobileIPv4 (RFC4004) DIAMETER Mobile IPv6 (RFC5447) DIAMETER Proxy Mobile IPv6 (RFC5779) Traffic classification QoS attributes (RFC5777) DIAMETER QoS (RFC5866) DIAMETER Base Protocol (RFC3588) Transport (TCP, SCTP) (RFC3539) AAA protocols - Lecture 4b 21
22 Basic operation DIAMETER (command names) Command-Name Abbrev. Code (Authent/Authz-Request ) (Authent/Authz-Answer) Abort-Session-Request ASR 274 Abort-Session-Answer ASA 274 Accounting-Request ACR 271 Accounting-Answer ACA 271 Capabilities-Exchange- Request CER 257 Capabilities-Exchange- Answer CEA 257 Device-Watchdog-Request DWR 280 Device-Watchdog-Answer DWA 280 Disconnect-Peer-Request DPR 282 Disconnect-Peer-Answer DPA 282 Re-Auth-Request RAR 258 Re-Auth-Answer RAA 258 Session-Termination- Request STR 275 Session-Termination-Answer STA 275 AAA protocols - Lecture 4b 22
23 Basic operation DIAMETER (session establishment) Separate Authorization and Accounting sessions maintained, but using the same DIAMETER server Diameter client Diameter Server Authen/Authz session established * Accounting session established Authen/Authz Success Acc-Interim-Interval expires *Commands and number of rounds are application specific AAA protocols - Lecture 4b 23
24 Basic operation DIAMETER (session re-authorization) Separate Authorization and Accounting sessions maintained, but using same DIAMETER server Diameter client Diameter Server Authz-Lifetime expires Authen/Authz Success Re-Authorization successful Initiates Authen/Authz procedure Event: Re-authorization required Authen/Authz Success Re-Authorization successful AAA protocols - Lecture 4b 24
25 Basic operation DIAMETER (session termination) Separate Authorization and Accounting sessions maintained, but using same DIAMETER server Stops Authz session or initiates STR/STA exchange Authorization session is stopped Diameter client Diameter Server Event: Stop session Final accounting is triggered Accounting session is stopped AAA protocols - Lecture 4b 25
26 Outline Goal of this lecture What s AAA? Basic operation RADIUS Basic operation DIAMETER Main differences DIAMETER vs. RADIUS Summary & References AAA protocols - Lecture 4b 26
27 Main differences DIAMETER vs. RADIUS Better Transport Diameter runs over reliable transport, TCP or SCTP lost packets are retransmitted at each hop persistent connection with application-level heartbeat message (called a Watchdog message) supports timely failover TCP and SCTP adapt to network congestion Better Proxying Hop-by-hop transport failure detection allows failover to occur at the appropriate place proxies can locally failover to alternate next-hop peer proxy automatically does retransmission of pending request messages following failover. AAA protocols - Lecture 4b 27
28 Main differences DIAMETER vs. RADIUS Better Session Control Session management: independent of accounting accounting information can be routed to different server than authentication/authorization messages correlation between sessions needed => Acct-Multi-Session-Id AVP session termination may be conveyed by a specific Session- Termination message rather than Accounting Stop message (when session ID authorization and session ID accounting different). server may initiate message to request session termination server may initiate message to request re-authentication and/or reauthorization of user Better Security Hop-by-hop security is provided using IPsec or TLS Automatic secret key exchange End-to-end security is guaranteed AAA protocols - Lecture 4b 28
29 Outline Goal of this lecture What s AAA? Basic operation RADIUS Basic operation DIAMETER Main differences DIAMETER vs. RADIUS Summary & References AAA protocols - Lecture 4b 29
30 Summary, references & info homework assignments Understand: AAA concept Main characteristics of RADIUS protocol Main characteristics of DIAMETER protocol Main differences between RADIUS and DIAMETER References Many used RFCs can be located via <then type RFC number> RFC1321, RFC2903, RFC2905, RFC2904, RFC1492, RFC2865, RFC3588, RFC2866, RFC2869, RFC3579, RFC3162, RFC4372, RFC3580, RFC4740, RFC5447, RFC5624, RFC5777, RFC5778 RFC5779, RFC5866 AAA protocols - Lecture 4b 30
31 Summary, references & info homework assignments Homework assignments can be found via Blackboard and via: answers to homework exercises need to be sent by to following address before Monday 01 October, 23:55! Please Include "Lecture number (4B) and the number (4.B.1, 4.B.2, 4.B.3) of the exercise(s)" in the title/subject line of the ? address: AAA protocols - Lecture 4b 31
Authentication, Authorization and Accounting (AAA) Protocols
Authentication, Authorization and Accounting (AAA) Protocols Agententechnologien in der Telekommunikation Sommersemester 2009 Babak Shafieian babak.shafieian@dai-labor.de 10.06.2009 Agententechnologien
UNIVERZITA KOMENSKÉHO V BRATISLAVE FAKULTA MATEMATIKY, FYZIKY A INFORMATIKY PRÍPRAVA ŠTÚDIA MATEMATIKY A INFORMATIKY NA FMFI UK V ANGLICKOM JAZYKU
UNIVERZITA KOMENSKÉHO V BRATISLAVE FAKULTA MATEMATIKY, FYZIKY A INFORMATIKY PRÍPRAVA ŠTÚDIA MATEMATIKY A INFORMATIKY NA FMFI UK V ANGLICKOM JAZYKU ITMS: 26140230008 DOPYTOVO ORIENTOVANÝ PROJEKT Moderné
Introduction to centralized Authentication, Authorization and Accounting (AAA) management for distributed IP networks
Introduction to centralized Authentication, Authorization and Accounting (AAA) management for distributed IP networks IETF 89 - Tutorials London, England March 2-7, 2014 Presented by: Lionel Morand Co-authored
Lecture 3. WPA and 802.11i
Lecture 3 WPA and 802.11i Lecture 3 WPA and 802.11i 1. Basic principles of 802.11i and WPA 2. IEEE 802.1X 3. Extensible Authentication Protocol 4. RADIUS 5. Efficient Handover Authentication 1 Lecture
RADIUS Authentication and Accounting
5 RADIUS Authentication and Accounting Contents Overview...................................................... 5-2 Terminology................................................... 5-3 Switch Operating Rules
Chapter 4: Security of the architecture, and lower layer security (network security) 1
Chapter 4: Security of the architecture, and lower layer security (network security) 1 Outline Security of the architecture Access control Lower layer security Data link layer VPN access Wireless access
3GPP TS 29.161 V6.3.0 (2007-12)
TS 29.161 V6.3.0 (2007-12) Technical Specification 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Interworking between the Public Land Mobile Network (PLMN)
Review: Lecture 1 - Internet History
Review: Lecture 1 - Internet History late 60's ARPANET, NCP 1977 first internet 1980's The Internet collection of networks communicating using the TCP/IP protocols 1 Review: Lecture 1 - Administration
A Dynamic Extensible Authentication Protocol for Device Authentication in Transport Layer Raghavendra.K 1, G. Raghu 2, Sumith N 2
A Dynamic Extensible Authentication Protocol for Device Authentication in Transport Layer Raghavendra.K 1, G. Raghu 2, Sumith N 2 1 Dept of CSE, P.A.College of Engineering 2 Dept of CSE, Srnivas institute
CENTRALIZED AUTHENTICATION SERVICES (RADIUS, TACACS, DIAMETER)
83-10-32 DATA SECURITY MANAGEMENT CENTRALIZED AUTHENTICATION SERVICES (RADIUS, TACACS, DIAMETER) Bill Stackpole INSIDE Key Features of an AAA Service; RADIUS: Remote Authentication Dial-in User Service;
freeradius A High Performance, Open Source, Pluggable, Scalable (but somewhat complex) RADIUS Server Aurélien Geron, Wifirst, January 7th 2011
freeradius A High Performance, Open Source, Pluggable, Scalable (but somewhat complex) RADIUS Server Aurélien Geron, Wifirst, January 7th 2011 freeradius is... Multiple protocoles : RADIUS, EAP... An Open-Source
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
ETSI TS 129 161 V10.0.1 (2011-04) Technical Specification
TS 129 161 V10.0.1 (2011-04) Technical Specification Universal Mobile Telecommunications System (UMTS); LTE; Interworking between the Public Land Mobile Network (PLMN) supporting packet based services
7.1. Remote Access Connection
7.1. Remote Access Connection When a client uses a dial up connection, it connects to the remote access server across the telephone system. Windows client and server operating systems use the Point to
7750 SR OS System Management Guide
7750 SR OS System Management Guide Software Version: 7750 SR OS 10.0 R4 July 2012 Document Part Number: 93-0071-09-02 *93-0071-09-02* This document is protected by copyright. Except as specifically permitted
Diameter in the Evolved Packet Core
Diameter in the Evolved Packet Core A Whitepaper November 2009 Page 2 DIAMETER in the Evolved Packet Core Mobile broadband is becoming a reality, as the Internet generation grows accustomed to having broadband
CHAPTER NO. TITLE PAGE NO.
xii CHAPTER NO. TITLE PAGE NO. 4 INTEGRATED DESIGN OF WEB SERVICE ACCOUNTING ARCHITECTURE 84 4.1 DESIGN OF INTEGRATED ACCOUNTING MODULES 84 4.1.1 Accounting Record Formats 87 4.1.2 WS-Radius Protocol 91
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Spirent Abacus. SIP over TLS Test 编 号 版 本 修 改 时 间 说 明
Spirent Abacus SIP over TLS Test 编 号 版 本 修 改 时 间 说 明 1 1. TLS Interview (Transport Layer Security Protocol) (1) TLS Feature Introduction: 1. TLS is a successor of Secure Sockets Layer (SSL), a cryptographic
Portal Authentication Technology White Paper
Portal Authentication Technology White Paper Keywords: Portal, CAMS, security, authentication Abstract: Portal authentication is also called Web authentication. It authenticates users by username and password
Network Security. Lecture 3
Network Security Lecture 3 Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Security protocols application transport network datalink physical Contents IPSec overview
RadSec RADIUS improved. Stig Venaas venaas@uninett.no
RadSec RADIUS improved Stig Venaas venaas@uninett.no Overview RADIUS overview RadSec overview What is wrong with RADIUS RadSec benefits Radsec implementations, deployment and standardisation RADIUS overview
Signaling Delivery Controller : Control Your 4G Network
Data Sheet Traffix Systems Signaling Delivery Controller : Control Your 4G Network The Traffix Signaling Delivery Controller (SDC) assists operators in scaling and managing services and applications in
NAT TCP SIP ALG Support
The feature allows embedded messages of the Session Initiation Protocol (SIP) passing through a device that is configured with Network Address Translation (NAT) to be translated and encoded back to the
Session Border Controller
CHAPTER 13 This chapter describes the level of support that Cisco ANA provides for (SBC), as follows: Technology Description, page 13-1 Information Model Objects (IMOs), page 13-2 Vendor-Specific Inventory
7450 ESS OS System Management Guide. Software Version: 7450 ESS OS 10.0 R1 February 2012 Document Part Number: 93-0101-09-01 *93-0101-09-01*
7450 ESS OS System Management Guide Software Version: 7450 ESS OS 10.0 R1 February 2012 Document Part Number: 93-0101-09-01 *93-0101-09-01* This document is protected by copyright. Except as specifically
Network Access Control and Cloud Security
Network Access Control and Cloud Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
This presentation discusses the new support for the session initiation protocol in WebSphere Application Server V6.1.
This presentation discusses the new support for the session initiation protocol in WebSphere Application Server V6.1. WASv61_SIP_overview.ppt Page 1 of 27 This presentation will provide an overview of
Authentication and Security in IP based Multi Hop Networks
7TH WWRF MEETING IN EINDHOVEN, THE NETHERLANDS 3RD - 4TH DECEMBER 2002 1 Authentication and Security in IP based Multi Hop Networks Frank Fitzek, Andreas Köpsel, Patrick Seeling Abstract Network security
Network Access Control and Cloud Security
Network Access Control and Cloud Security Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Cisco IOS Technologies: RADIUS Support in Cisco IOS Software
Cisco IOS Technologies: RADIUS Support in Cisco IOS Software White Paper Overview As networks grow beyond the campus, network security increases in importance and administration complexity. Customers need
Network Security Part II: Standards
Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview
RADIUS: A REMOTE AUTHENTICATION DIAL-IN USER SERVICE
InSight: RIVIER ACADEMIC JOURNAL, VOLUME 5, NUMBER 2, FALL 2009 RADIUS: A REMOTE AUTHENTICATION DIAL-IN USER SERVICE Daniel Szilagyi*, Arti Sood** and Tejinder Singh M.S. in Computer Science Program, Rivier
Cisco Secure ACS. By Igor Koudashev, Systems Engineer, Cisco Systems Australia ivk@cisco.com. 2006 Cisco Systems, Inc. All rights reserved.
Cisco Secure ACS Overview By Igor Koudashev, Systems Engineer, Cisco Systems Australia ivk@cisco.com 2006 Cisco Systems, Inc. All rights reserved. 1 Cisco Secure Access Control System Policy Control and
International Telecommunication Union. IETF Security Work. Magnus Nyström. Technical Director, RSA Security Presentation made on behalf of the IETF
International Telecommunication Union IETF Security Work Magnus Nyström Technical Director, RSA Security Presentation made on behalf of the IETF Background Internet Engineering Task Force o International
IP Security. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49
IP Security Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security
Scenario: Remote-Access VPN Configuration
CHAPTER 7 Scenario: Remote-Access VPN Configuration A remote-access Virtual Private Network (VPN) enables you to provide secure access to off-site users. ASDM enables you to configure the adaptive security
Communication Security for Applications
Communication Security for Applications Antonio Carzaniga Faculty of Informatics University of Lugano March 10, 2008 c 2008 Antonio Carzaniga 1 Intro to distributed computing: -server computing Transport-layer
Cisco Which VPN Solution is Right for You?
Table of Contents Which VPN Solution is Right for You?...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1 Components Used...1 NAT...2 Generic Routing Encapsulation Tunneling...2
VPN. Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu
VPN Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu What is VPN? A VPN (virtual private network) is a private data network that uses public telecommunicating infrastructure (Internet), maintaining
VoIP Security. Seminar: Cryptography and Security. 07.06.2006 Michael Muncan
VoIP Security Seminar: Cryptography and Security Michael Muncan Overview Introduction Secure SIP/RTP Zfone Skype Conclusion 1 Introduction (1) Internet changed to a mass media in the middle of the 1990s
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
Security. AAA Identity Management. Premdeep Banga, CCIE #21713. Cisco Press. Vivek Santuka, CCIE #17621. Brandon J. Carroll, CCIE #23837
AAA Identity Management Security Vivek Santuka, CCIE #17621 Premdeep Banga, CCIE #21713 Brandon J. Carroll, CCIE #23837 Cisco Press 800 East 96th Street Indianapolis, IN 46240 ix Contents Introduction
An Experimental Study of Cross-Layer Security Protocols in Public Access Wireless Networks
An Experimental Study of Cross-Layer Security Protocols in Public Access Wireless Networks Avesh K. Agarwal Wenye Wang Department of Electrical and Computer Engineering North Carolina State University,
Mobile IP Part I: IPv4
Mobile IP Part I: IPv4 Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse574-06/ 12-1 q Mobile
Evaluation of EAP Authentication Methods in Wired and Wireless Networks
Master Thesis Electrical Engineering October 2012 Evaluation of EAP Authentication Methods in Wired and Wireless Networks Tirumala Rao Kothaluru Mohamed Youshah Shameel Mecca School of Computing Blekinge
How To Create A Virtual Network With A Router And Network Operating System (Ip) For A Network (Ipv) (Ip V2) (Netv) And A Virtualization) (Network) (Wired) (Virtual) (Wire)
Post-IP technologies virtualization and security Guy Pujolle 1 Virtualization for a post-ip network 2 Geni Intel would like to propose a generic router Intel proposes to have a generic hardware with virtual
Web Security Considerations
CEN 448 Security and Internet Protocols Chapter 17 Web Security Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa
EAP-WAI Authentication Protocol
EAP-WAI Authentication Protocol draft-richard-emu-wai-00 Richard 2009-07-26 Stockholm, IETF 75th Preface WAPI is a WLAN security protocol and brought forward By a Standard Group in China. It was invited
Chapter 9. IP Secure
Chapter 9 IP Secure 1 Network architecture is usually explained as a stack of different layers. Figure 1 explains the OSI (Open System Interconnect) model stack and IP (Internet Protocol) model stack.
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
Diameter Security. Ensuring the Transport and Application Layer Integrity of Diameter across Network Interconnections
Diameter Security Ensuring the Transport and Application Layer Integrity of Diameter across Network Interconnections Table of Contents Introduction..................................... 3 Diameter Security..................................
Application Note User Groups
Application Note User Groups Application Note User Groups Table of Contents Background... 3 Description... 3 Benefits... 4 Theory of Operation... 4 Interaction with Other Features... 6 Configuration...
Application Note: Onsight Device VPN Configuration V1.1
Application Note: Onsight Device VPN Configuration V1.1 Table of Contents OVERVIEW 2 1 SUPPORTED VPN TYPES 2 1.1 OD VPN CLIENT 2 1.2 SUPPORTED PROTOCOLS AND CONFIGURATION 2 2 OD VPN CONFIGURATION 2 2.1
Bit Chat: A Peer-to-Peer Instant Messenger
Bit Chat: A Peer-to-Peer Instant Messenger Shreyas Zare shreyas@technitium.com https://technitium.com December 20, 2015 Abstract. Bit Chat is a peer-to-peer instant messaging concept, allowing one-to-one
Network Access Security. Lesson 10
Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.
Vesselin Tzvetkov, Holger Zuleger {vesselin.tzvetkov, holger.zuleger}@arcor.net Arcor AG&Co KG, Alfred-Herrhausen-Allee 1, 65760 Eschborn, Germany
Service Provider implementation of SIP regarding security Vesselin Tzvetkov, Holger Zuleger {vesselin.tzvetkov, holger.zuleger}@arcor.net Arcor AG&Co KG, Alfred-Herrhausen-Allee 1, 65760 Eschborn, Germany
IPv6 Fundamentals Ch t ap 1 er I : ntroducti ti t on I o P IPv6 Copyright Cisco Academy Yannis Xydas
IPv6 Fundamentals Chapter 1: Introduction ti to IPv6 Copyright Cisco Academy Yannis Xydas The Network Today The Internet of today is much different that it was 30, 15 or 5 years ago. 2 Technology Tomorrow
Configuring CSS Remote Access Methods
CHAPTER 11 Configuring CSS Remote Access Methods This chapter describes how to configure the Secure Shell Daemon (SSH), Remote Authentication Dial-In User Service (RADIUS), and the Terminal Access Controller
Configuring Wired 802.1x Authentication on Windows Server 2012
Configuring Wired 802.1x Authentication on Windows Server 2012 Johan Loos johan@accessdenied.be Version 1.0 Why 802.1x Authentication? The purpose of this document is to guide you through the procedure
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch.
Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch.20 Long term and short term solutions to Internet scalability
Computer Networks. Secure Systems
Computer Networks Secure Systems Summary Common Secure Protocols SSH HTTPS (SSL/TSL) IPSec Wireless Security WPA2 PSK vs EAP Firewalls Discussion Secure Shell (SSH) A protocol to allow secure login to
Cisco Certified Security Professional (CCSP)
529 Hahn Ave. Suite 101 Glendale CA 91203-1052 Tel 818.550.0770 Fax 818.550.8293 www.brandcollege.edu Cisco Certified Security Professional (CCSP) Program Summary This instructor- led program with a combination
3GPP TSG SA WG3 Security S3#25 S3-020572 8-11 October 2002 Munich, Germany
3GPP TSG SA WG3 Security S3#25 S3-020572 8-11 October 2002 Munich, Germany Title: Response to: Source: To: Cc: Liaison on HTTP Security investigation within IMS LS S3-020475 (S2-022609) on Liaison on Security
ETM System SIP Trunk Support Technical Discussion
ETM System SIP Trunk Support Technical Discussion Release 6.0 A product brief from SecureLogix Corporation Rev C SIP Trunk Support in the ETM System v6.0 Introduction Today s voice networks are rife with
Scenario: IPsec Remote-Access VPN Configuration
CHAPTER 3 Scenario: IPsec Remote-Access VPN Configuration This chapter describes how to use the security appliance to accept remote-access IPsec VPN connections. A remote-access VPN enables you to create
Case Study for Layer 3 Authentication and Encryption
CHAPTER 2 Case Study for Layer 3 Authentication and Encryption This chapter explains the basic tasks for configuring a multi-service, extranet Virtual Private Network (VPN) between a Cisco Secure VPN Client
Implementing Secured Converged Wide Area Networks (ISCW) Version 1.0
COURSE OVERVIEW Implementing Secure Converged Wide Area Networks (ISCW) v1.0 is an advanced instructor-led course that introduces techniques and features that enable or enhance WAN and remote access solutions.
Real-Time Communication Security: SSL/TLS. Guevara Noubir noubir@ccs.neu.edu CSU610
Real-Time Communication Security: SSL/TLS Guevara Noubir noubir@ccs.neu.edu CSU610 1 Some Issues with Real-time Communication Session key establishment Perfect Forward Secrecy Diffie-Hellman based PFS
IP Security. IPSec, PPTP, OpenVPN. Pawel Cieplinski, AkademiaWIFI.pl. MUM Wroclaw
IP Security IPSec, PPTP, OpenVPN Pawel Cieplinski, AkademiaWIFI.pl MUM Wroclaw Introduction www.akademiawifi.pl WCNG - Wireless Network Consulting Group We are group of experienced professionals. Our company
SIP : Session Initiation Protocol
: Session Initiation Protocol EFORT http://www.efort.com (Session Initiation Protocol) as defined in IETF RFC 3261 is a multimedia signaling protocol used for multimedia session establishment, modification
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
Overview SSL/TLS HTTPS SSH. TLS Protocol Architecture TLS Handshake Protocol TLS Record Protocol. SSH Protocol Architecture SSH Transport Protocol
SSL/TLS TLS Protocol Architecture TLS Handshake Protocol TLS Record Protocol HTTPS SSH SSH Protocol Architecture SSH Transport Protocol Overview SSH User Authentication Protocol SSH Connection Protocol
SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide with Enhanced Logging
SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide with Enhanced Logging 1 Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your system. CAUTION:
An MPLS-Based Micro-mobility Solution
An MPLS-Based Micro-mobility Solution IEEE-802.21-Based Control Plane Rajendra Persaud 1, Ralf Wienzek 1, Gerald Berghoff 2, and Ralf Schanko 2 1 Chair of Computer Science 4, RWTH Aachen University, Germany
10CS64: COMPUTER NETWORKS - II
QUESTION BANK 10CS64: COMPUTER NETWORKS - II Part A Unit 1 & 2: Packet-Switching Networks 1 and Packet-Switching Networks 2 1. Mention different types of network services? Explain the same. 2. Difference
RADIUS Vendor-Specific Attributes (VSA)
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the network access server and the RADIUS server by using the vendor-specific
End-to-End Quality-of-Service Support in Next Generation Networks with NSIS
End-to-End Quality-of-Service Support in Next Generation Networks with NSIS Roland Bless, Martin Röhricht Karlsruhe Institute of Technology, Germany Institute of Telematics, Department of Computer Science
Internet Protocol: IP packet headers. vendredi 18 octobre 13
Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)
Pulse Policy Secure. RADIUS Server Management Guide. Product Release 5.1. Document Revision 1.0. Published: 2015-02-10
Pulse Policy Secure RADIUS Server Management Guide Product Release 5.1 Document Revision 1.0 Published: 2015-02-10 2015 by Pulse Secure, LLC. All rights reserved iii Pulse Secure, LLC 2700 Zanker Road,
Communication Systems 16 th lecture. Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009
16 th lecture Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009 1 25 Organization Welcome to the New Year! Reminder: Structure of Communication Systems lectures
Security Engineering Part III Network Security. Security Protocols (II): IPsec
Security Engineering Part III Network Security Security Protocols (II): IPsec Juan E. Tapiador jestevez@inf.uc3m.es Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,
Interconnecting Cisco Networking Devices Part 2
Interconnecting Cisco Networking Devices Part 2 Course Number: ICND2 Length: 5 Day(s) Certification Exam This course will help you prepare for the following exam: 640 816: ICND2 Course Overview This course
642 523 Securing Networks with PIX and ASA
642 523 Securing Networks with PIX and ASA Course Number: 642 523 Length: 1 Day(s) Course Overview This course is part of the training for the Cisco Certified Security Professional and the Cisco Firewall
Secure SCADA Network Technology and Methods
Secure SCADA Network Technology and Methods FARKHOD ALSIHEROV, TAIHOON KIM Dept. Multimedia Engineering Hannam University Daejeon, South Korea sntdvl@yahoo.com, taihoonn@paran.com Abstract: The overall
MOBILE VIDEO WITH MOBILE IPv6
MOBILE VIDEO WITH MOBILE IPv6 DANIEL MINOLI WILEY A JOHN WILEY & SONS, INC., PUBLICATION CONTENTS PREFACE ABOUT THE AUTHOR xi xiii 1 THE MOBILE USER ENVIRONMENT: SMART PHONES, PORTABLE MEDIA PLAYERS (PMPs),
radsecproxy 1.3-beta Stig Venaas venaas@uninett.no
radsecproxy 1.3-beta Stig Venaas venaas@uninett.no Overview Why a RADIUS proxy? Overview and basic features Simple configuration example Advanced features and configuration Dynamic server discovery Availability
Cisco Secure Access Control Server Deployment Guide
Cisco Secure Access Control Server Deployment Guide 2007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 1 of 58 Contents Introduction... 4 Cisco Secure ACS...
EXPLOITING SIMILARITIES BETWEEN SIP AND RAS: THE ROLE OF THE RAS PROVIDER IN INTERNET TELEPHONY. Nick Marly, Dominique Chantrain, Jurgen Hofkens
Nick Marly, Dominique Chantrain, Jurgen Hofkens Alcatel Francis Wellesplein 1 B-2018 Antwerp Belgium Key Theme T3 Tel : (+32) 3 240 7767 Fax : (+32) 3 240 8485 E-mail : Nick.Marly@alcatel.be Tel : (+32)
Interlink Networks RAD-Series AAA Server and RSA Security Two-Factor Authentication
Interlink Networks RAD-Series AAA Server and RSA Security Two-Factor Authentication As the world increasingly depends on computers to do business, the need for safeguarding computer resources also increases.
Internet Architecture for Robust Mobility. Sangheon Pack (백상헌) Korea University shpack@korea.ac.kr
Internet Architecture for Robust Mobility Sangheon Pack (백상헌) Korea University shpack@korea.ac.kr Contents Introduction IETF Activity Home Agent Reliability Protocol P2P-based Approaches ROAM and SAMP
VPN SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region
VPN SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the
640-816: Interconnecting Cisco Networking Devices Part 2 v1.1
640-816: Interconnecting Cisco Networking Devices Part 2 v1.1 Course Introduction Course Introduction Chapter 01 - Small Network Implementation Introducing the Review Lab Cisco IOS User Interface Functions
Belnet Networking Conference 2013
Belnet Networking Conference 2013 Thursday 12 December 2013 @ http://events.belnet.be Workshop roaming services: eduroam / govroam Belnet Aris Adamantiadis, Nicolas Loriau Bruxelles 05 December 2013 Agenda
Web Security (SSL) Tecniche di Sicurezza dei Sistemi 1
Web Security (SSL) Tecniche di Sicurezza dei Sistemi 1 How the Web Works - HTTP Hypertext transfer protocol (http). Clients request documents (or scripts) through URL. Server response with documents. Documents
This chapter describes how to set up and manage VPN service in Mac OS X Server.
6 Working with VPN Service 6 This chapter describes how to set up and manage VPN service in Mac OS X Server. By configuring a Virtual Private Network (VPN) on your server you can give users a more secure
Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer
Other VPNs TLS/SSL, PPTP, L2TP Advanced Computer Networks SS2005 Jürgen Häuselhofer Overview Introduction to VPNs Why using VPNs What are VPNs VPN technologies... TLS/SSL Layer 2 VPNs (PPTP, L2TP, L2TP/IPSec)
z/os Firewall Technology Overview
z/os Firewall Technology Overview Mary Sweat E - Mail: sweatm@us.ibm.com Washington System Center OS/390 Firewall/VPN 1 Firewall Technologies Tools Included with the OS/390 Security Server Configuration