Search

In this paper, we present the architecture of agent that supports integrated management for firewalls and implemented the prototype of the A-ISMSF(Agent-based Integrated Security Management System for Firewalls). The agent is a component of A-ISMSF consists of web client, integration engine and agents. The design of agent focuses on the scalability to newly introduces or expanded firewall structure so that minimal changes are needed to manage another firewall. An agent initiates with SNMP security MIB, monitors the status of a firewall, and executes control requests from integration engine. Keywords: Agent, SNMP, Integrated Security Management, Secure MIB, Firewall. [ABSTRACT FROM AUTHOR]

Since policy-based network technologies emerged themselves, a number of policy-based applications have been tried in the field of communications, which are just independent applications in accordance with policy-based management by each area. Particularly, lots of them were concerned with security and QoS areas. A single policy claims the control of network resources according to relations between network state and its application demand. We attempted to model and evaluate the effect of policy-based applications which were independently applicable to each area on network resources. For the purpose, we defined the complexity, dynamic property and globalization of policy as a matrix affecting its applications, including parameters with influences upon each matrix. Our evaluation results suggest that, in designing a policy-based network, there must be construction factors carefully considered according to their application attributes. [ABSTRACT FROM AUTHOR]

In the paper, we presented the method of safeguard selection for the effective risk mitigation using a qualitative method. We provided the suitable selection method of safeguard's method/technique according to risk type, and performed cost-benefit analysis. In the selection of the safeguard method, we recommended the suitable method among risk avoidance, transference, prevention, threats reduction and impacts reduction, etc. according to risk type. After selecting the safeguard method, we chose the safeguard technique considering organization's IT system capability such as IT system and network structure, functionality, exclusiveness and achievability of safeguard, etc. And then, we applied the safeguard technique to the safeguard method for implement effective security technology. We performed cost-benefit analysis with candidate safeguards, considering organization's security budget. As performing this procedure, we can decide optimal safeguards with methods and techniques against risk's types before implementing safeguards. We also can prevent redundant works and security budgets waste as analyzing the efficiency of existing safeguard. Lastly, we reflected the organization's CEO opinions to require special safeguards for the specific information system related to their core business. [ABSTRACT FROM AUTHOR]

Many transition mechanisms and scenarios have studied for the using of IPv6 network efficiently. The VPN in IPv4 network is the main security application. Also it is necessary to use VPN during the transition period to IPv6 network. The VPN service provides the confidentiality and integrity for transmitted packets. But there are some difficulties to connect end-to-end VPN without a conversion between IPv4 and IPv6. Therefore, we analyze the suitability of the various applying model of VPN in conjunction with the transition mechanisms and evaluate the performance cost of this model. In the case of using the transition mechanism and VPN technology simultaneous, we can know the performance factors as follows: whether end points of the VPN tunnel and IP tunnel agree upon or not, the applying place of transition mechanism and VPN model according to network environment. Therefore, it should consider carefully evaluated applying model according to the required security level and connectivity. [ABSTRACT FROM AUTHOR]

With the proliferation of mobile terminals, use of the Internet in mobile environments is becoming more common. In order to support mobility in these terminals, Mobile IPv4 was proposed, representing the standard in IPv4 environments. In this environment, authentication should be mandatory, because mobile terminals can utilize Internet services in all foreign domains. Mobile IPv4 provides symmetric key based authentication using the default HMAC-MD5. However, symmetric key based authentication creates a problem, when it comes to key distribution. In order to solve this problem, public key based authentication mechanisms were proposed. In this paper, the performance of each of these mechanisms is evaluated. The results demonstrate that, among these mechanisms, partial certificate based authentication results in superior performance, and certificate based authentication results in the worst performance. This paper creates the possibility of public key based authentication mechanisms being used for future mobile terminal authentication, although current public key based authentication mechanisms result in lower performance than symmetric key based authentication. [ABSTRACT FROM AUTHOR]

Mobile IPv6 is a protocol that guarantees mobility of mobile node within the IPv6 environment. However current Mobile IPv6 supports simple the mobility of the mobile nodes and does not offer any special mechanism to reduce the handoff delay. For the purpose of reducing the handoff delay, Hierarchical Mobile IPv6 has been studied. However Hierarchical Mobile IPv6 supports the micro mobility only in the area managed by mobility anchor point. Therefore, the handoff delay problem still has been unsolved when mobile node moves to another mobility anchor point. In this paper, we propose GDMHA (Geographically Distributed Multiple HAs) mechanism to provide macro mobility between the mobility anchor points. Using this mechanism, a mobile node performs Binding Update with the nearest Home Agent, so that the delay of Binding Update process can be reduced. It also reduces the handoff delay. [ABSTRACT FROM AUTHOR]

This paper provides an analytical framework for comparison between centralized and distributed models of policy-based network management (PBNM). Policy-based networks are being deployed in a variety of applications, in which the policy-enabled architecture may provide appropriate performance control depending on the particular application being used. Therefore, in this paper, each PBNM model is evaluated based on the performance and scalability provided when a policy is provisioned. Our metrics include a qualitative evaluation of the policy provisioning time, the amount of traffic measured between the PBNM components and PDP utilization. Each approach has its own merits and demerits depending on the particular application requirement. We highlight the fact that an appropriate architecture needs to be introduced, in order to optimize the PBNM deployment. The PBNM modeling framework presented in this paper is intended to quantity the merits and demerits of the currently available methodologies. [ABSTRACT FROM AUTHOR]