802.1X-autentikoinnin käyttöönotto toimistoverkossa

Tämän insinöörityön tarkoituksena on tutkia, mitä 802.1x-autentikoinnin käyttöönotto toimistoverkossa vaatii. Aluksi tutkitaan autentikoinnissa tarvittavat komponentit ja niiden toiminta teorian kannalta. Kun teorian puolesta kaikki on selvää, on aika viedä teoria käytäntöön ja muodostaa olemassa olevien komponenttien avulla toimiva 802.1x-autentikointi. Autentikointiin tarvittavat asetukset esitetään yksityiskohtaisesti, jotta autentikointi olisi mahdollista toteuttaa myös muissa ympäristöissä. Muodostuksen jälkeen tutkitaan autentikoinnista saatavia lokeja ja selvitetään niiden tarkoitus. Jos saavutettu lopputulos on halutun kaltainen, otetaan 802.1x-autentikointi käyttöön koko toimistoverkossa.

PEAP 802.1x-tunnistuksen toteutus RADIUS-palvelimeen

Valimo iDServer -tunnistuspalvelin on ohjelmisto, joka tukee eri käyttäjientunnistusmenetelmiä, kuten tekstiviestillä lähetettävää kertakäyttösalasanaa tai normaaliakäyttäjätunnusta ja salasanaa. Tässä diplomityössä kuvataan, kuinka palvelimeenon lisätty tuki käyttäjien kirjautumiselle langattoman verkon tukiasemien ja virtuaalilähiverkkoa tukevien kytkinten kautta käyttäen normaaleja Windows-käyttöjärjestelmän mukana tulevia asiakasohjelmistoja. Työn ensimmäisessä vaiheessa kuvataan lähtökohdat ja vaatimukset tulevalle järjestelmälle. Työn osana käytännössä tehty kokonaisuus muodostuu useista eri määrityksistä koostuvista osista. Työn toisessa vaiheessa käydään läpi korkealla tasolla sovelluksen vaatimat protokollat. Osana näihin protokolliin kuului erilaisten avainten jatarkisteiden laskenta sekä salausmenetelmien käyttö, jotka myös kuvataan tässä työssä. Viimeisessä kappaleessa analysoidaan työn tuloksia jakäydään läpi toteutukseen ja itse sovelluksen toimintaan liittyvät ongelmat. Suurin osa havaituista ongelmista liittyi tilanteisiin, joihin itse palvelinsovelluksen toteutuksella ei voitu vaikuttaa. Eniten ongelmia aiheuttivat asiakasohjelmiston sekä verkkokorttien ja niiden ajureiden toiminta ongelmatilanteissa. Asiakasohjelmistoa ei selkeästi ole suunniteltu käytettäväksi kuin muuttumattomien salasanojen kanssa, koska käyttäjän näkökulmasta käyttökokemus ei ollut optimaalinen. Ongelmista huolimatta työn tuloksena saatiin asiakkaan vaatimukset täyttävä järjestelmä. Myös tuotekehitysnäkökulmasta projektia voitaneen pitää onnistuneena, koska nyt tehty sovellus luo pohjan uusien tunnistustapojen ja menetelmien toteuttamiselle tuotteen jatkokehitystä ajatellen.

Platform Architectures for Policy-Based Network Access Control

Tämä diplomityö käsittelee sääntöpohjaisen verkkoon pääsyn hallinnan (NAC) ratkaisuja arkkitehtonisesta näkökulmasta. Työssä käydään läpi Trusted Computing Groupin, Microsoft Corporationin, Juniper Networksin sekä Cisco Systemsin NAC-ratkaisuja. NAC koostuu joukosta uusia sekä jo olemassa olevia teknologioita, jotka auttavat ennalta määriteltyyn sääntökantaan perustuen hallitsemaan suojattuun verkkoon pyrkivien laitteiden tietoliikenneyhteyksiä. Käyttäjän tunnistamisen lisäksi NAC pystyy rajoittamaan verkkoon pääsyä laitekohtaisten ominaisuuksien perusteella, esimerkiksi virustunnisteisiin ja käyttöjärjestelmäpäivityksiin liittyen ja paikkaamaan tietyin rajoituksin näissä esiintyviä puutteita verkkoon pääsyn sallimiseksi. NAC on verraten uusi käsite, jolta puuttuu tarkka määritelmä. Tästä johtuen nykymarkkinoilla myydään ominaisuuksiltaan puutteellisia tuotteita NAC-nimikkeellä. Standardointi eri valmistajien NAC-komponenttien yhteentoimivuuden takaamiseksi on meneillään, minkä perusteella ratkaisut voidaan jakaa joko avoimia standardeja tai valmistajakohtaisia standardeja noudattaviksi. Esitellyt NAC-ratkaisut noudattavat standardeja joko rajoitetusti tai eivät lainkaan. Mikään läpikäydyistä ratkaisuista ei ole täydellinen NAC, mutta Juniper Networksin ratkaisu nousee niistä potentiaalisimmaksi jatkokehityksen ja -tutkimuksen kohteeksi TietoEnator Processing & Networks Oy:lle. Eräs keskeinen ongelma NAC-konseptissa on työaseman tietoverkolle toimittama mahdollisesti valheellinen tietoturvatarkistuksen tulos, minkä perusteella pääsyä osittain hallitaan. Muun muassa tähän ongelmaan ratkaisuna voisi olla jo nykytietokoneista löytyvä TPM-siru, mikä takaa tiedon oikeellisuuden ja koskemattomuuden.

Analysis and Design of a secure WLAN solution for Cobre Las Cruces

Cobre Las Cruces is a renowned copper mining company located in Sevilla, with unexpected problems in wireless communications that have a direct affectation in production. Therefore, the main goals are to improve the WiFi infrastructure, to secure it and to detect and prevent from attacks and from the installation of rogue (and non-authorized) APs. All of that integrated with the current ICT infrastructure.This project has been divided into four phases, although only two of them have been included into the TFC; they are the analysis of the current situation and the design of a WLAN solution.Once the analysis part was finished, some weaknesses were detected. Subjects such as lack of connectivity and control, ignorance about installed WiFi devices and their localization and state and, by and large, the use of weak security mechanisms were some of the problems found. Additionally, due to the fact that the working area became larger and new WiFi infrastructures were added, the first phase took more time than expected.As a result of the detailed analysis, some goals were defined to solve and it was designed a centralized approach able to cope with them. A solution based on 802.11i and 802.1x protocols, digital certificates, a probe system running as IDS/IPS and ligthweight APs in conjunction with a Wireless LAN Controller are the main features.

Diseño y configuración de una red de comunicaciones en un Centro de Contactos - Contact Center

Este proyecto muestra una solución de red para una empresa que presta servicios de Contact Center desde distintas sedes distribuidas geográficamente, utilizando la tecnología de telefonía sobre IP. El objetivo de este proyecto es el de convertirse en una guía de diseño para el despliegue de soluciones de red utilizando los actuales equipos de comunicaciones desarrollados por el fabricante Cisco Systems, Inc., los equipos de seguridad desarrollados por el fabricante Fortinet y los sistemas de telefonía desarrollados por Avaya Inc. y Oracle Corporation, debido a su gran penetración en el mercado y a las aportaciones que cada uno ha realizado en el sector de Contact Center. Para poder proveer interconexión entre las sedes de un Contact Center se procede a la contratación de un acceso a la red MPLS perteneciente a un operador de telecomunicaciones, quien provee conectividad entre las sedes utilizando la tecnología VPN MPLS con dos accesos diversificados entre sí desde cada una de las sedes del Contact Center. El resultado de esta contratación es el aprovechamiento de las ventajas que un operador de telecomunicaciones puede ofrecer a sus clientes, en relación a calidad de servicio, disponibilidad y expansión geográfica. De la misma manera, se definen una serie de criterios o niveles de servicio que aseguran a un Contact Center una comunicación de calidad entre sus sedes, entendiéndose por comunicación de calidad aquella que sea capaz de transmitirse con unos valores mínimos de pérdida de paquetes así como retraso en la transmisión, y una velocidad acorde a la demanda de los servicios de voz y datos. Como parte de la solución, se diseña una conexión redundante a Internet que proporciona acceso a todas las sedes del Contact Center. La solución de conectividad local en cada una de las sedes de un Contact Center se ha diseñado de manera general acorde al volumen de puestos de usuarios y escalabilidad que pueda tener cada una de las sedes. De esta manera se muestran varias opciones asociadas al equipamiento actual que ofrece el fabricante Cisco Systems, Inc.. Como parte de la solución se han definido los criterios de calidad para la elección de los Centros de Datos (Data Center). Un Contact Center tiene conexiones hacia o desde las empresas cliente a las que da servicio y provee de acceso a la red a sus tele-trabajadores. Este requerimiento junto con el acceso y servicios publicados en Internet necesita una infraestructura de seguridad. Este hecho da lugar al diseño de una solución que unifica todas las conexiones bajo una única infraestructura, dividiendo de manera lógica o virtual cada uno de los servicios. De la misma manera, se ha definido la utilización de protocolos como 802.1X para evitar accesos no autorizados a la red del Contact Center. La solución de voz elegida es heterogénea y capaz de soportar los protocolos de señalización más conocidos (SIP y H.323). De esta manera se busca tener la máxima flexibilidad para establecer enlaces de voz sobre IP (Trunk IP) con proveedores y clientes. Esto se logra gracias a la utilización de SBCs y a una infraestructura interna de voz basada en el fabricante Avaya Inc. Los sistemas de VoIP en un Contact Center son los elementos clave para poder realizar la prestación del servicio; por esta razón se elige una solución redundada bajo un entorno virtual. Esta solución permite desplegar el sistema de VoIP desde cualquiera de los Data Center del Contact Center. La solución llevada a cabo en este proyecto está principalmente basada en mi experiencia laboral adquirida durante los últimos siete años en el departamento de comunicaciones de una empresa de Contact Center. He tenido en cuenta los principales requerimientos que exigen hoy en día la mayor parte de empresas que desean contratar un servicio de Contact Center. Este proyecto está dividido en cuatro capítulos. El primer capítulo es una introducción donde se explican los principales escenarios de negocio y áreas técnicas necesarias para la prestación de servicios de Contact Center. El segundo capítulo describe de manera resumida, las principales tecnologías y protocolos que serán utilizados para llevar a cabo el diseño de la solución técnica de creación de una red de comunicaciones para una empresa de Contact Center. En el tercer capítulo se expone la solución técnica necesaria para permitir que una empresa de Contact Center preste sus servicios desde distintas ubicaciones distribuidas geográficamente, utilizando dos Data Centers donde se centralizan las aplicaciones de voz y datos. Finalmente, en el cuarto capítulo se presentan las conclusiones obtenidas tras la elaboración de la presente memoria, así como una propuesta de trabajos futuros, que permitirían junto con el proyecto actual, realizar una solución técnica completa incluyendo otras áreas tecnológicas necesarias en una empresa de Contact Center. Todas las ilustraciones y tablas de este proyecto son de elaboración propia a partir de mi experiencia profesional y de la información obtenida en diversos formatos de la bibliografía consultada, excepto en los casos en los que la fuente es mencionada. ABSTRACT This project shows a network solution for a company that provides Contact Center services from different locations geographically distributed, using the Telephone over Internet Protocol (ToIP) technology. The goal of this project is to become a design guide for performing network solutions using current communications equipment developed by the manufacturer Cisco Systems, Inc., firewalls developed by the manufacturer Fortinet and telephone systems developed by Avaya Inc. and Oracle Corporation, due to their great market reputation and their contributions that each one has made in the field of Contact Center. In order to provide interconnection between its different sites, the Contact Center needs to hire the services of a telecommunications’ operator, who will use the VPN MPLS technology, with two diversified access from each Contact Center’s site. The result of this hiring is the advantage of the benefits that a telecommunications operator can offer to its customers, regarding quality of service, availability and geographical expansion. Likewise, Service Level Agreement (SLA) has to be defined to ensure the Contact Center quality communication between their sites. A quality communication is understood as a communication that is capable of being transmitted with minimum values of packet loss and transmission delays, and a speed according to the demand for its voice and data services. As part of the solution, a redundant Internet connection has to be designed to provide access to every Contact Center’s site. The local connectivity solution in each of the Contact Center’s sites has to be designed according to its volume of users and scalability that each one may have. Thereby, the manufacturer Cisco Systems, Inc. offers several options associated with the current equipment. As part of the solution, quality criteria are being defined for the choice of the Data Centers. A Contact Center has connections to/from the client companies that provide network access to teleworkers. This requires along the access and services published on the Internet, needs a security infrastructure. Therefore is been created a solution design that unifies all connections under a single infrastructure, dividing each services in a virtual way. Likewise, is been defined the use of protocols, such as 802.1X, to prevent unauthorized access to the Contact Center’s network. The voice solution chosen is heterogeneous and capable of supporting best-known signaling protocols (SIP and H.323) in order to have maximum flexibility to establish links of Voice over IP (IP Trunk) with suppliers and clients. This can be achieved through the use of SBC and an internal voice infrastructure based on Avaya Inc. The VoIP systems in a Contact Center are the key elements to be able to provide the service; for this reason a redundant solution under virtual environment is been chosen. This solution allows any of the Data Centers to deploy the VoIP system. The solution carried out in this project is mainly based on my own experience acquired during the past seven years in the communications department of a Contact Center company. I have taken into account the main requirements that most companies request nowadays when they hire a Contact Center service. This project is divided into four chapters. The first chapter is an introduction that explains the main business scenarios and technical areas required to provide Contact Center services. The second chapter describes briefly the key technologies and protocols that will be used to carry out the design of the technical solution for the creation of a communications network in a Contact Center company. The third chapter shows a technical solution required that allows a Contact Center company to provide services from across geographically distributed locations, using two Data Centers where data and voice applications are centralized. Lastly, the fourth chapter includes the conclusions gained after making this project, as well as a future projects proposal, which would allow along the current project, to perform a whole technical solution including other necessary technologic areas in a Contact Center company All illustrations and tables of this project have been made by myself from my professional experience and the information obtained in various formats of the bibliography, except in the cases where the source is indicated.

Distribuição de vídeo sobre uma rede IEEE 802.11n

A recente norma IEEE 802.11n oferece um elevado débito em redes locais sem fios sendo por isso esperado uma adopção massiva desta tecnologia substituindo progressivamente as redes 802.11b/g. Devido à sua elevada capacidade esta recente geração de redes sem fios 802.11n permite um crescimento acentuado de serviços audiovisuais. Neste contexto esta dissertação procura estudar a rede 802.11n, caracterizando o desempenho e a qualidade associada a um serviço de transmissão de vídeo, recorrendo para o efeito a uma arquitectura de simulação da rede 802.11n. Desta forma é caracterizado o impacto das novas funcionalidades da camada MAC introduzidas na norma 801.11n, como é o caso da agregação A-MSDU e A-MPDU, bem como o impacto das novas funcionalidades da camada física como é o caso do MIMO; em ambos os casos uma optimização da parametrização é realizada. Também se verifica que as principais técnicas de codificação de vídeo H.264/AVC para optimizar o processo de distribuição de vídeo, permitem optimizar o desempenho global do sistema de transmissão. Aliando a optimização e parametrização da camada MAC, da camada física, e do processo de codificação, é possível propor um conjunto de configurações que permitem obter o melhor desempenho na qualidade de serviço da transmissão de conteúdos de vídeo numa rede 802.11n. A arquitectura de simulação construída nesta dissertação é especificamente adaptada para suportar as técnicas de agregação da camada MAC, bem como para suportar o encapsulamento em protocolos de rede que permitem a transmissão dos pacotes de vídeo RTP, codificados em H.264/AVC.

On the use of IEEE 802.15.4/Zigbee for time-sensitive wireless sensor network applications

Mestrado em Engenharia Electrotécnica e de Computadores

A 802.11p prototype implementation

This paper presents an IEEE 802.11p full-stack prototype implementation to data exchange among vehicles and between vehicles and the roadway infrastructures. The prototype architecture is based on FPGAs for Intermediate Frequency (IF) and base band purposes, using 802.11a based transceivers for RF interfaces. Power amplifiers were also addressed, by using commercial and in-house solutions. This implementation aims to provide technical solutions for Intelligent Transportation Systems (ITS) field, namely for tolling and traffic management related services, in order to promote safety, mobility and driving comfort through the dynamic and real-time cooperation among vehicles and/or between vehicles and infrastructures. The performance of the proposed scheme is tested under realistic urban and suburban driving conditions. Preliminary results are promising, since they comply with most of the 802.11p standard requirements.

IEEE 802.15.4 for wireless sensor networks: a technical overview

Low-rate low-power consumption and low-cost communication are the key points that lead to the specification of the IEEE 802.15.4 standard. This paper overviews the technical features of the physical layer and the medium access control sublayer mechanisms of the IEEE 802.15.4 protocol that are most relevant for wireless sensor network applications. We also discuss the ability of IEEE 802.15.4 to fulfil the requirements of wireless sensor network applications.

An Explicit GTS allocation algorithm for IEEE 802.15.4

The IEEE 802.15.4 standard provides appealing features to simultaneously support real-time and non realtime traffic, but it is only capable of supporting real-time communications from at most seven devices. Additionally, it cannot guarantee delay bounds lower than the superframe duration. Motivated by this problem, in this paper we propose an Explicit Guaranteed time slot Sharing and Allocation scheme (EGSA) for beacon-enabled IEEE 802.15.4 networks. This scheme is capable of providing tighter delay bounds for real-time communications by splitting the Contention Free access Period (CFP) into smaller mini time slots and by means of a new guaranteed bandwidth allocation scheme for a set of devices with periodic messages. At the same the novel bandwidth allocation scheme can maximize the duration of the CFP for non real-time communications. Performance analysis results show that the EGSA scheme works efficiently and outperforms competitor schemes both in terms of guaranteed delay and bandwidth utilization.

Energy efficient scheduling for cluster-tree wireless sensor networks with time-bounded data flows: application to IEEE 802.15.4/ZigBee

Cluster scheduling and collision avoidance are crucial issues in large-scale cluster-tree Wireless Sensor Networks (WSNs). The paper presents a methodology that provides a Time Division Cluster Scheduling (TDCS) mechanism based on the cyclic extension of RCPS/TC (Resource Constrained Project Scheduling with Temporal Constraints) problem for a cluster-tree WSN, assuming bounded communication errors. The objective is to meet all end-to-end deadlines of a predefined set of time-bounded data flows while minimizing the energy consumption of the nodes by setting the TDCS period as long as possible. Sinceeach cluster is active only once during the period, the end-to-end delay of a given flow may span over several periods when there are the flows with opposite direction. The scheduling tool enables system designers to efficiently configure all required parameters of the IEEE 802.15.4/ZigBee beaconenabled cluster-tree WSNs in the network design time. The performance evaluation of thescheduling tool shows that the problems with dozens of nodes can be solved while using optimal solvers.

An implicit GTS allocation mechanism in IEEE 802.15.4 for time-sensitive wireless sensor networks: theory and practice

Timeliness guarantee is an important feature of the recently standardized IEEE 802.15.4 protocol, turning it quite appealing for Wireless Sensor Network (WSN) applications under timing constraints. When operating in beacon-enabled mode, this protocol allows nodes with real-time requirements to allocate Guaranteed Time Slots (GTS) in the contention-free period. The protocol natively supports explicit GTS allocation, i.e. a node allocates a number of time slots in each superframe for exclusive use. The limitation of this explicit GTS allocation is that GTS resources may quickly disappear, since a maximum of seven GTSs can be allocated in each superframe, preventing other nodes to benefit from guaranteed service. Moreover, the GTS may be underutilized, resulting in wasted bandwidth. To overcome these limitations, this paper proposes i-GAME, an implicit GTS Allocation Mechanism in beacon-enabled IEEE 802.15.4 networks. The allocation is based on implicit GTS allocation requests, taking into account the traffic specifications and the delay requirements of the flows. The i-GAME approach enables the use of one GTS by multiple nodes, still guaranteeing that all their (delay, bandwidth) requirements are satisfied. For that purpose, we propose an admission control algorithm that enables to decide whether to accept a new GTS allocation request or not, based not only on the remaining time slots, but also on the traffic specifications of the flows, their delay requirements and the available bandwidth resources. We show that our approach improves the bandwidth utilization as compared to the native explicit allocation mechanism defined in the IEEE 802.15.4 standard. We also present some practical considerations for the implementation of i-GAME, ensuring backward compatibility with the IEEE 801.5.4 standard with only minor add-ons. Finally, an experimental evaluation on a real system that validates our theoretical analysis and demonstrates the implementation of i-GAME is also presented

Simulation study of energy efficient scheduling for IEEE 802.15.4/ZigBee cluster-treeWireless Sensor Networks with time-bounded data flows

The simulation analysis is important approach to developing and evaluating the systems in terms of development time and cost. This paper demonstrates the application of Time Division Cluster Scheduling (TDCS) tool for the configuration of IEEE 802.15.4/ZigBee beaconenabled cluster-tree WSNs using the simulation analysis, as an illustrative example that confirms the practical applicability of the tool. The simulation study analyses how the number of retransmissions impacts the reliability of data transmission, the energy consumption of the nodes and the end-to-end communication delay, based on the simulation model that was implemented in the Opnet Modeler. The configuration parameters of the network are obtained directly from the TDCS tool. The simulation results show that the number of retransmissions impacts the reliability, the energy consumption and the end-to-end delay, in a way that improving the one may degrade the others.