Skip to content
Microsystems, Electronics and Acoustics
ISSN 2523-4447 · e‑ISSN 2523-4455 Open Access · CC BY-SA 4.0
Vol. 22 · Issue 6 · 2017 Dec 20, 2017 Telecommunications and information security

Methods and technologies for computer networks protection (the physical and data link layers)

PK
Pavlo Valentynovych Kucherniuk Corresponding National Technical University of Ukraine “Igor Sikorsky Kyiv Polytechnic Institute” Ukraine
Pages64-70 PublishedDec 20, 2017
PDF (Ukrainian)
VOL 22 · ISS 6 · 2017 View issue

Abstract

Standard solutions that are supported by manufacturers of equipment for computer networks (switches the 2nd and 3rd levels, routers), implemented in the operating systems and protocols, and can be used for the development and implementation of integrated corporate network protection systems are considered in this article. The article is the first of a series of articles devoted to the analysis of methods and technologies of protection. The typical threats to computer network at the physical (physical damage of the data channels, unauthorized changes in the functional environment, disabling physical data channels, setting noise over the entire bandwidth of the channel) and data link (the generation of broadcasting frames to overload the data channels and switching equipment, the substitution of nodes MAC address, attacks on ARP and Spanning-Tree protocols) layers of OSI model are given and the features of methods and technologies to protect are analyzed. The features of use of limited and unlimited signal transmission media in terms of information security are considered at the physical level and a number of additional measures top prevent unauthorized changes in the functional medium networks are given (such as: the limitation of physical access to cable channels, switching nodes and data centers, the development and implementation of a policy of remote access to network equipment, deployment of auxiliary video surveillance and access control systems, redundancy of the most critical channels, network devices and servers). At the data link layer are analyzed such functions of switches as Port security, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard; segmenting the network into separate zones using the technology of Virtual Local Area Network to broadcast restrictions and improving information security; implementation of network access control system with authentication and authorization at the data link layer. To implement the access control systems of the channel level the features of the 802.1x protocol are considered and its main disadvantage (the lack of data encryption, which may lead to data interception and the implementation of DoS attacks) is determined. To build more secure solutions are proposed to use the combination of IPSec and 802.1x or new IEEE 802.1AE protocols (MACsec protocols that solve privacy and data integrity problems) and the IEEE 802.1AR standard, which defines a unique secure device identifier for their authorization. Analysis of methods and protection technologies at the physical and data link levels of the OSI model which was conducted in work allows making informed decisions about choosing methods to protect networks for different purposes and with different requirements regarding data protection. References 17, Tables 1.

Keywords

#security #threats #protection #computer networks #firewalls

References

  1. M. V. Graivoronsky and O. M. Novikov, Bezpeka informatsino-komunikatsinikh sistem [Safety of the information and communication systems]. Kyiv, Ukrane: Vydavnicha hrupa BHV, 2009.
  2. V. Maksimov, “Mezhsetevyie ekrany. Sposoby organizatsii zaschity i [Firewalls. Ways to organize protection],” Computerpress, no. 3, pp. 68–69, 2003. URL: http://compress.ru/article.aspx?id=10145
  3. “Apparatnye mezhsetevye ekrany [Firewalls],” InfoBezpeka. [Online]. Available: http://www.infobezpeka.com/products/apatnye/ .
  4. B. Y. Korniienko, “Doslidzhennia modeli vzaiemodii vidkrytykh system z pohliadu informatsiinoi bezpeky [Research of open systems interconnection model in terms of information security],” Sci. Technol., vol. 15, no. 3, pp. 83–89, Nov. 2012. DOI: 10.18372/2310-5461.15.5120
  5. A. O. Dovhal, “Klasifikatsiia zahroz bezpeky v informatsiinii merezhi [Classification of security threats in the information network],” in IX International Scientific Conference of Young Scientists “Electronics-2016,” 2016.
  6. P. V. Kucherniuk, Osnovy postroeniia informatsionnykh setey: uchebnoe posobie dlia studentov spetsialnosti «Radioelektronnye apparaty i sredstva» [Fundamentals of information networks: Textbook for students of specialty "Radio-electronic devices and equipment]. Kyiv, Ukraine: NTUU “KPI,” 2014. URI: http://ela.kpi.ua/handle/123456789/8071
  7. P. V. Kucherniuk, Kompiuterni merezhi: navchalnii posibnyk z distsipliny «Kompiuterni merezhi ta zasoby telekomunikatsii» dlia studentiv spetsialnosti 7.05090201, 8.05090201 «Radioelektronni aparaty ta zasoby» [Computer Networks: Textbook on discipline "Computer networks a. Kyiv, Ukraine: NTUU “KPI,” 2014. URI: http://ela.kpi.ua/handle/123456789/12042
  8. N. Ferguson, B. Schneier, and T. Kohno, Cryptography engineering: design principles and practical applications. Indianapolis, USA: Wiley Publishing, 2010. ISBN: 978-0470474242
  9. A. A. Petrov, Kompiuternaia bezopasnost. Kriptohraficheskie metody zaschyty [Computer security. Cryptography protection methods]. Moskow, Russia: DMK Press, 2008. ISBN: 5-89818-064-8
  10. R. Seifert and J. Edwards, The all-new switch book: the complete guide to LAN switching technology, 2nd ed. Indianapolis, IN, USA: Wiley Publishing, cop., 2008. ISBN: 978-0470287156
  11. F. H. Y. Bhaiji, Network security technologies and solutions. Indianapolis, IN, USA: Cisco Press, 2008. ISBN: 978-1-58705-246-0
  12. V. Olifer and N. Olifer, Novye tekhnologii i oborudovanie IP-setei [New technologies and equipment of IP-networks]. St.-Peterburg, Russia: Bhv, 2000. ISBN: 5-8206-0053-3
  13. “IEEE 802.1: 802.1X-2001 - Port Based Network Access Control,” IEEE 802, 2001. [Online]. Available: http://www.ieee802.org/1/pages/802.1x-2001.html .
  14. “Obzor i tipy EAP [EAP Overview and types],” 2017. [Online]. Available: https://www.intel.ru/content/www/ru/ru/support/articles/000006999/network-and-i-o/wireless-networking.html .
  15. privilege15, “IEEE 802.1x,” TelecomBook, 2010. [Online]. Available: http://telecombook.ru/archive/network/cisco/directory/53-ieee-802-1x-cisco .
  16. “802.1AE: MAC Security (MACsec),” IEEE 802, 2006. [Online]. Available: https://1.ieee802.org/security/802-1ae/ .
  17. “P802.1AR-Rev: Secure Device Identity (Revision) |,” IEEE 802, 2017. [Online]. Available: https://1.ieee802.org/security/802-1ar-rev/ .
§ 06 — Related

Similar articles in this journal

Related peer-reviewed studies published in this journal.
View all issues

Application of the genetic algorithm for agent-based modeling of the object behavior while leaving the flaming room

Yaroslaw Yuriiovychych Dorogyy, Vasyl V Tsurkan, Anton S Dembitskyi

The article deals with the implementation of the genetic algorithm for training and optimization of the neural network and its application to the tasks related to…

#neural networks #genetic algorithm #training without a teacher #agent-based modelling
p. 71-78
10.20535/2523-4455.2017.22.6.105199

An active method application for the chromatic dispersion compensation aimed to increase the transmіssion capabilities of the fiber-optical linear path

Ivan-Viacheslav Oleksanrovych Serhiienko

Suggested an active method for the compensation of the chromatic dispersion in fiber-optical linear path. The method is based on using the features of the dynamic…

#fiber-optic linear path #super-gaussian pulse #chromatic dispersion #transmitter frequency pulse pre-modulation
p. 54-62
10.20535/2523-4455.2017.22.5.90195

Most read articles by the same author(s)

Similar Articles

1-10 of 37

You may also start an advanced similarity search for this article.