1 Kyung Hee University Prof. Choong Seon HONG Network Control

2 Kyung Hee University Introduction  Network control : modifying parameters in and causing actions to be taken by the end systems, intermediate systems and subsystems  Performance, fault and accounting : related to monitoring  Configurations and Security : related to control

3 Kyung Hee University Configuration Management  Concerned with the initialization and maintenance, and shutdown of individual components and logical subsystems Managed resources : including as follows. l Identifiable physical resources (for example, a server or router) l Lower-level logical objects (for example, a transport-layer retransmission timer) Configuration values l Specifying default values for attributes l Possessing proper parameter values  Performance management and configuration management functions If performance management monitoring function detects that response time is degrading due to an imbalance in load, Configuration management may adjust the configuration to achieve load level.

4 Kyung Hee University Configuration Management (cont’d)  Fault management and configuration management If fault management detects and isolates a fault, Configuration management may alter the configuration to by bypass the fault  Functions of configuration management Define configuration information Set and modify attribute values Define and modify relationships Initialize and terminate network operations Distribute software Examine values and relationships (through query-response interaction) Report on configuration status (via an event report)

5 Kyung Hee University Configuration Management (cont’d)  Define Configuration Information Configuration information l including a specification of the resources under management and the attributes of those resources l A simple structured list of data fields l An object-oriented database l A relational database : the structure of the database reflects the relationships among network elements network resources l Physical resources : end systems, routers, bridges, communication facilities, services, communication media, and modems l Logical resources : timers, counters, states, operational characters, software version number, and release level Network control function l Should enable the user to specify the range and type of values l Should be able to define new object type, or data type element types (on- line or off-line)

6 Kyung Hee University Configuration Management (cont’d)  Set and Modify Attribute Values Configuration management function should enable a manager station to remotely set and modify attribute values in agents and proxies l A manger must be authorized l Some attributes reflect the “reality” at a resource and cannot be modified remotely. ( just by a physical action at the router) Three categories of configurable attributes for modification l Database update only – changing contact information l Database update plus resource modification – for example, physical port id set to “disabled” and agent not only updates the state attribute but also disables the port l Database update plus action – if an authorized manger sets a reinitialize parameter to TRUE, the router would go through a reinitialization procedure

7 Kyung Hee University Configuration Management (cont’d)  Define and Modify Relationships Relationship describes an association, connection, or condition that exists between network resources or network components l topology, hierarchy, physical and logical connection, or a management domain l One example of the use of relationship – managing link layer connection between LAN nodes LLC protocol in one node can issue a connection request to another node A network manger station could set up a fixed LLC connection between two nodes; This connection set up would designate the SAP (service access point) in each node

8 Kyung Hee University Configuration Management (cont’d)  Data relationships foo blee bar Devices Vendors Contacts Allan Karen Banzai Hack

9 Kyung Hee University Configuration Management (cont’d)  Initialize and Terminate Network Operations Initialization : including verification that all settable resource attributes and relationships have been properly set, notifying users of any resource, attribute, or relationship still needing to be set, and validating users’ initialization commands. Termination : allowing users to request retrieval of specified statistics, blocks, or status information before the terminal procedures have completed  Distribute Software software loading requests transmitting the specified versions of software updating the configuration tracking systems updating routing tables

10 Kyung Hee University Security control  Security Threats a definition of security requirement l Secrecy : reading by authorized parties l Integrity : can modified only by authorized parties l Availability : available to authorized parties

11 Kyung Hee University Security control (cont’d)  Types of Threats Interruption l destroyed or become unavailable or unusable l a threat to availability Interception l an unauthorized party gains access to an asset l a threat to secrecy Modification l an unauthorized party not only gains access but tampers with an asset l a threat to integrity Fabrication l an unauthorized party inserts counterfeit objects into the system l a threat to integrity

12 Kyung Hee University Security control (cont’d) Information source Information destination Normal Flow Interruption Modification Interception Fabrication

13 Kyung Hee University Security control (cont’d)  Security threats to Network DATA Hardware device Software Communication Lines Modification Interception (capture, analysis) Masquerade Interruption (loss) Interruption (Theft, denial of service) Interception Modification Interruption (deletion) Masquerade Modification Interruption (loss) Interception (capture, analysis)

14 Kyung Hee University Security control (cont’d)  Steps in an example of Security Management (step 1) identifying the sensitive information to be protected (step 2) finding the access points (step 3) securing the access points (step 4) maintaining the secure access points l Note: access points: software services, hardware components, and network media Disk with sensitive information Router Data Network Services: remote login file transfer Monitoring system Console Query (step 4) (step 1) (step3) (step 2)

15 Kyung Hee University Security control (cont’d)  Identifying sensitive information accounting, financial, customer, market, engineering and employment  Finding the access points remote login, file transfer, electronic mail, remote process execution, file and directory servers, name servers  Securing the access points on the data link level: use encryption on the network level: use packet filters on every host level: use host authentication, user authentication and key authentication  Maintaining the secure access points basis for auditing network security: potential network access points and their required security deploy programs to check for commonly known security problems: trying passwords and encryption key offering on the public network cash prizes