Implementing Security for ATM Networks

by Thomas D Tarman, Edward L Witzke

Overview

Noting that the growth of asynchronous transfer mode (ATM) technology in voice, video, and data networking increase security concerns, Tarman and Witzke, technicians at the Sandia National Laboratories of the US Department of Energy, explain to network architects how to enforce security policies within their infrastructures, provide security device implementers with some of the background and philosophy underlying the mechanisms of basic researchers, and review the current status and future prospects of ATM security for researchers. Annotation c. Book News, Inc., Portland, OR (booknews.com)

Product Details

ISBN-13:	9781580532938
Publisher:	Artech House, Incorporated
Publication date:	12/28/2001
Series:	Artech House Computer Security Series
Pages:	318
Product dimensions:	6.28(w) x 9.22(h) x 1.00(d)

About the Author

Thomas D. Tarman and Edward L. Witzke are members of the technical staff at Sandia National Laboratories, a research and development facility for the United States Department of Energy, in Albuquerque, New Mexico. Mr. Tarman holds a BS. in computer and electrical engineering, and an M.S. in electrical engineering, both from Purdue University. Mr. Witzke holds a Bachelor of University Studies with a concentration in computer science from the University of New Mexico.

Table of Contents

	Foreword	xiii
	Preface	xvii
	Acknowledgments	xxi
Part I	Fundamentals	1
1	Introduction to Network Security	3
1.1	Up-Front Security Analysis	3
1.1.1	Threats and Assets That Require Protection	4
1.1.2	Usage Policies	7
1.1.3	Attack Methods	8
1.1.4	Determining Countermeasures	8
1.1.5	Trust in Countermeasures	9
1.1.6	Balancing Acceptable Risk with Cost of Countermeasures	11
1.2	Protection Countermeasures	12
1.2.1	Encryption	12
1.2.2	Authentication	16
1.2.3	Authorization	21
1.2.4	Access Control	21
1.2.5	Auditing	22
1.3	Trade-Offs and Optimizations	23
	References	23
2	ATM Networking Fundamentals	25
2.1	ATM Reference Model	26
2.2	Cell Switching	31
2.3	ILMI	36
2.4	ATM Virtual Circuit Signaling	37
2.5	Routing ATM Connections	40
2.6	Multipoint Connections	43
2.7	Operations and Management	45
2.8	ATM Traffic Management	47
2.9	ATM Services	50
2.9.1	Classical IP over ATM	51
2.9.2	LANE	52
2.9.3	Multiprotocol over ATM	54
2.10	Summary	56
	References	56
Part II	Using ATM Security	59
3	ATM Security Using Traditional ATM Features	61
3.1	Implementing ATM Connection Policies	62
3.1.1	Access Control via Circuit Provisioning	63
3.1.2	Access Control for Signaled ATM Circuits	67
3.2	Network Configuration Security	71
3.3	Summary	74
	References	75
4	ATM Security Using the ATM Forum Security 1.1 Mechanisms	77
4.1	Security 1.1 Model	78
4.1.1	Security Agent	80
4.1.2	Security Message Transport	84
4.2	Security 1.1 Services	89
4.2.1	Security Message Exchange	90
4.2.2	User Plane Security Services	95
4.2.3	Control Plane Security Services	105
4.3	Summary	107
	References	107
Part III	Implementing ATM Security	109
5	SME Protocol	111
5.1	SME Fundamentals	112
5.1.1	Two-Way Message Exchange	112
5.1.2	Three-Way Message Exchange	114
5.1.3	Endpoint Requests for Security Services	116
5.2	SME Details	117
5.2.1	SSIE	117
5.2.2	Security Agent Addressing	122
5.2.3	Security Association Establishment	128
5.3	SME Message Transport	133
5.3.1	UNI 4.0 Point-to-Point Signaling	133
5.3.2	In-Band	137
5.3.3	Pt-Mpt Connections	143
5.3.4	Signaling-Based with In-Band Fallback	144
5.3.5	Endpoint Requests for Proxy Security Services	144
5.4	Summary	146
	References	147
6	Initial Authentication	149
6.1	Authentication Protocols	151
6.2	Using Secret-Key MACs	153
6.2.1	Keyed Message Digests	153
6.2.2	Block Cipher in CBC Mode	154
6.3	Using Public-Key Signature Algorithms	154
6.4	Example	156
6.4.1	Initiator Security Agent (Host) Processing	157
6.4.2	Responder Security Agent (Firewall) Processing	158
6.4.3	Initiator Security Agent (Host) Processing	160
6.5	Summary	161
	References	161
7	Data Origin Authentication	163
7.1	Implementation Overview	164
7.2	Implementation Details	165
7.3	Keyed MACs	167
7.4	SME and Data Origin Authentication	169
7.5	Control Plane Authentication and Integrity	170
7.6	Summary	171
	References	172
8	Encryption	173
8.1	Block Algorithms	174
8.2	Public-Key Versus Secret-Key Algorithms	176
8.2.1	RSA	176
8.2.2	Diffie-Hellman	177
8.2.3	DES	177
8.2.4	FEAL	180
8.3	Modes of Operation	180
8.3.1	CBC Mode	181
8.3.2	Counter Mode	182
8.4	Key Agility	184
8.4.1	Context Lookup	185
8.4.2	Encryption State	185
8.5	Encryptor Architecture	186
8.5.1	Component Modules	188
8.5.2	Resynchronization Processing for the Sample Architecture	192
8.6	State Maintenance Using OAM Cells	193
8.6.1	SKU	196
8.6.2	Cryptographic Resynchronization	197
8.7	Performance Considerations	198
	References	199
9	Access Control	201
9.1	General Access Control	202
9.2	Label-Based Access Control	204
9.2.1	FIPS 188	206
9.2.2	Label Transport in ATM Security	209
9.3	Summary	211
	References	211
10	PNNI Routing Security	213
10.1	Approach	214
10.2	Security Information Group	217
10.3	Control Plane Security and Link Establishment	221
10.4	Summary	223
	References	224
Part IV	Additional Topics in ATM Security	225
11	Future Standards Development Topics	227
11.1	Security-Based Routing and Discovery	227
11.2	Renegotiation of Security Associations	231
11.3	In-Band SME for Simplex Connections	234
11.4	Wireless ATM Security	237
11.4.1	Shared Media Access Security	239
11.4.2	Security Standards Support for Wireless ATM	239
11.5	Summary	242
	References	242
12	Research Topics	245
12.1	Algorithm- and Robustness-Agile Encryption	245
12.1.1	Robustness Agility	246
12.1.2	Algorithm Agility	246
12.2	Control Plane Confidentiality	249
12.3	Control Plane Authentication	252
12.4	ATM Intrusion Detection	255
12.4.1	Switched Network Intrusion Detection	257
12.4.2	Anatomy of Intrusion Detection Systems	258
12.4.3	Example Attack	261
12.4.4	Advanced Issues	262
	References	263
	Acronyms and Abbreviations	265
	Selected Bibliography	273
	About the Authors	281
	Index	283