Network Access Control System Research Articles

Implementation of Defense in Depth Strategy to Secure Industrial Control System in Critical Infrastructures

The goal of this communication is to examine the implementation of defense in depth strategy to secure the industrial control systems (ICS) from threats, hackers, vandals and other ones that can damage the critical infrastructures (gas transportation network, power transmission network, power generation, power distribution grids, air traffic, petrochemical industries, rail traffic, military industries) and others big infrastructures that affect large number of persons and security of nations [1]. The defense in depth concept ensures the physical access protection of the infrastructure, using network access control system (NAC) and traditional security measures, and implements policies and procedures that deal training and cybersecurity awareness programs, risk assessment (analyzing and documenting), and the plan of security. The philosophy of defense in depth uses also the IT technologies in order to ensure separation and segmentations of the networks to the VLANs, demilitarized zones, VPN, using firewalls, switch and routers. The hardening of different systems installed like routers, firewalls, switches and other devices on the network such as SCADA servers is a very sensitive operation of defense in depth. The last important operations are monitoring and maintenance, the monitoring serve to detect and stop intrusions attempts before they can damage the control system with using detection and protection system (IDS/IPS), and the maintenance operations control system (soft and hard), schedule updating of anti-virus software on different devices installed in the network like (computers, SCADA servers, routers, switch and other devices). The defense-in-depth recommendations described in this document can decrease the risk of attacks can target industrial network architectures, like VLAN hopping, SQL injection on SCADA, IP spoofing and DoS (denies of service) and others ones. The risk of attacks can use a common point of access as point of failures (RTU, corporate VPNs, database links, wireless communication, and IT controlled communication equipment). The implementation strict of the defense in depth concept can avoid important damage of critical infrastructures such as loss of production, damage to plant, impact on reputation, impact of health, impact of safety, impact of environment and impact on nation’s security.

A Behaviour Profiling Based Technique for Network Access Control Systems

A Behaviour Profiling Based Technique for Network Access Control Systems

Methods and technologies for computer networks protection (the physical and data link layers)

Standard solutions that are supported by manufacturers of equipment for computer networks (switches the 2nd and 3rd levels, routers), implemented in the operating systems and protocols, and can be used for the development and implementation of integrated corporate network protection systems are considered in this article. The article is the first of a series of articles devoted to the analysis of methods and technologies of protection. The typical threats to computer network at the physical (physical damage of the data channels, unauthorized changes in the functional environment, disabling physical data channels, setting noise over the entire bandwidth of the channel) and data link (the generation of broadcasting frames to overload the data channels and switching equipment, the substitution of nodes MAC address, attacks on ARP and Spanning-Tree protocols) layers of OSI model are given and the features of methods and technologies to protect are analyzed. The features of use of limited and unlimited signal transmission media in terms of information security are considered at the physical level and a number of additional measures top prevent unauthorized changes in the functional medium networks are given (such as: the limitation of physical access to cable channels, switching nodes and data centers, the development and implementation of a policy of remote access to network equipment, deployment of auxiliary video surveillance and access control systems, redundancy of the most critical channels, network devices and servers). At the data link layer are analyzed such functions of switches as Port security, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard; segmenting the network into separate zones using the technology of Virtual Local Area Network to broadcast restrictions and improving information security; implementation of network access control system with authentication and authorization at the data link layer. To implement the access control systems of the channel level the features of the 802.1x protocol are considered and its main disadvantage (the lack of data encryption, which may lead to data interception and the implementation of DoS attacks) is determined. To build more secure solutions are proposed to use the combination of IPSec and 802.1x or new IEEE 802.1AE protocols (MACsec protocols that solve privacy and data integrity problems) and the IEEE 802.1AR standard, which defines a unique secure device identifier for their authorization. Analysis of methods and protection technologies at the physical and data link levels of the OSI model which was conducted in work allows making informed decisions about choosing methods to protect networks for different purposes and with different requirements regarding data protection.References 17, Tables 1.

NAC 시스템의 시험방법과 평가사례에 관한 연구

Abstract With the advancement of internet and mobile communication devices, mobile banking such as internet banking, internet loan and smart phones related to the people's economic activities using mobile communication devices is becoming increasingly more popular. Various security systems to prevent such new crimes are being introduced and the security system market is anticipated to continuously increase substantially in the future. Accordingly, qualitative advancement of the security systems are also in continuous demand. Therefore, this thesis proposes the method and system for quality evaluation of the network access control system by proposing testing and evaluating method for the relevant system through surveying and analyzing the tend in the foundation technologies and standards in the area of network access control system, which is one of the security systems, in order to cope with the demands for the evaluation of the quality of the security system as the security system product market is anticipated to grow continuously.

Putting a Terminal Network Access Control System into Practice

The paper presents the concept and the main idea of network access control and uses the open source software (FreeRADIUS) as a basic framework. It brings in an terminal security status assessment ideas. At the same time, it designs and implements including authentication, configuration and implementation of security strategy and the security state of terminal evaluation as one of the terminal network access control system.

The NAC System in the Smart Grid Systems

During the process of the Smart Grid systems construction, the Safe Access Platform has an increasing important role. Not only could it meet the demand that people of power system can telecommute, but also provides different level of security mechanisms for various smart devices, such as Hand-hold Terminal System PDA, Ultra Mobile Personal Computer (UMPC) and Wireless Data Acquisition Terminal. Determining how to guarantee the internal security and meet the security requirements of access control based on roles is an important subject. The paper presents a new network access control system (NAC system) based on roles. According to the security metrics of the network access equipment (NAE), the NAC system has been designed and implemented to provide different safety strategies for different application scenarios. Besides, 802.1x and L2-IP are discussed specially as the most important key techniques of the implementation of the system.

Study of Network Access Control System Featuring Collaboratively Interacting Network Security Components

Draw lessons from Cisco network access control thought, proposed one kind based on the 802.1x protocol of a network component security interaction type network access control system design and implementation, and to the large campus network application background and describes in detail the development and deployment of technology of the system, including identity authentication, billing, network access control, information statistics safety linkage, form a variety of different network components linkage collaboration, the traditional first connection security evaluation network access mode changes for the first safety assessment after connection, significantly improve the security of network.

A Study of Network 2-Factor Access Control Model for Prevention the Medical-Data Leakage

Abstract Network Access Control system of medical asset protection solutions that installation and operation on system and network to provide a process that to access internal network after verifying the safety of information communication devices. However, there are still the internal medical-data leakage threats due to spoof of authorized devices and unauthorized using of users are away hours. In this paper, Network 2-Factor Access Control Model proposed for prevention the medical-data leakage by improving the current Network Access Control system. The proposed Network 2-Factor Access Control Model allowed to access the internal network only actual users located in specific place within the organization and used authorized devices. Therefore, the proposed model to provide a safety medical asset environment that protecting medical-data by blocking unauthorized access to the internal network and unnecessary internet access of authorized users and devices. Key Words : Access Control, Information Security, Identification, NAC, Medical Asset Protection

Semantic web-based social network access control

The existence of online social networks that include person specific information creates interesting opportunities for various applications ranging from marketing to community organization. On the other hand, security and privacy concerns need to be addressed for creating such applications. Improving social network access control systems appears as the first step toward addressing the existing security and privacy concerns related to online social networks. To address some of the current limitations, we have created an experimental social network using synthetic data which we then use to test the efficacy of the semantic reasoning based approaches we have previously suggested.

A network access control approach based on the AAA architecture and authorization attributes

Network access control mechanisms constitute an increasingly needed service, when communications are becoming more and more ubiquitous thanks to some technologies such as wireless networks or Mobile IP. This paper presents a particular scenario where access rules are based not only on the identity of the different users but also on authorization data related to those users. In order to accomplish this general goal, it will be necessary to add to the traditional system-specific services for authentication and authorization, and also some entities able to manage the information related to identity, roles and permissions. Network access will be based on the 802.1X framework and the Authentication, Authorization, and Accounting (AAA) architecture, as they constitute the basis for most of the existing proposals for limiting the access to a restricted network. These proposals will be extended making use of an authorization infrastructure based on SAML statements, the RBAC model, and XACML as the main language for expressing authorization policies. The solution that we present in this paper is a consequence of an exhaustive and non-trivial analysis of the different mechanisms that could be used to provide this kind of service. As we will see, the correct integration of these different mechanisms leads to the definition of a scalable and versatile network access control system which conforms to the guidelines outlined by the AAA initiative.

Implementación del control de acceso a la red mediante los protocolos de autenticación, autorización y auditoría

Este artículo presenta el diseño e implementación de un sistema de control de acceso a la red que proporciona elservicio de Autenticación, Autorización y Auditoría (AAA) usando software libre, empleando los protocolos estándarIEEE 802.1x y RADIUS, con base en una infraestructura de clave pública, un servicio de directorio centralizado quealmacena las políticas de seguridad para cada usuario y una base de datos MySQL en donde se registranlos eventosdel servicio AAA; todo esto se probó en un ambiente corporativo con 300 estaciones de trabajo. En el sistema selogró: tres métodos de autenticación mediante el uso de EAP-TLS, PEAP y EAP TTLS; la administración segura dela información, concerniente a los usuarios que pueden acceder la red y los permisos que cada uno de ellos posee;el uso de certificados digitales para demostrar la identidad de un usuario o de un equipo que ejecute cualquiera delos sistemas operativos más populares. También se ha configurado un servidor RADIUS para que use dos puntosde información de políticas; un servidor de directorio OpenLDAP y el Directorio Activo de Microsoft. Lo anteriorposibilita un control de acceso a red escalable, sin demandar un alto presupuesto.