Intelligent Transport Systems - Telenor

Figure 5 Interconnection of networks
126
A
were sloppy with regard to security and as thus
an easy prey for hackers.
One discomforting observation is that it is impossible
to construct a computer program that
can discover and destroy all viruses. This is hard
mathematical fact. The best we can do is to develop
a virus protection program when we know the
virus or some signature of it. The same mathematical
theory also proves that it is impossible
to construct a computer program that can debug
and remove every programming fault in an arbitrary
program. This leaves us in a situation
where we cannot protect ourselves against clever
virus attacks and against programming errors
that sometimes may cause an exchange or other
machine in the network to stop functioning.
The Web changed the attitude towards computer
networks. The configuration of computer networks
is explained in Figure 5. The core of this
configuration is the data network of a company
(called Internal in the figure). The internal network
consists of two main sectors: one which is
open for, for example, electronic mail, and one
that is closed and only accessible by employees.
The protected part of the network may consist of
several sub-sectors open for different groups of
employees. There are usually two types of user
of the internal network: users that are located on
the premises of the company (1), and users that
are located outside these premises (2) and
accessing the internal network via the external
network. On the other hand, there are users not
being employees of the company (3) that access
the internal network for electronic mail and
information that is publicly available (server B).
The internal users may also access external
servers (A) for information. Finally, there are
servers in the protected part of the network (C)
1
3
Internal
Protected
Open
External
that are accessible only for authorised personnel
in the company.
This configuration raises the following question.
How can we avoid external users being able to
penetrate into the protected part of the network?
We see that this problem is not trivial because
the company allows distant working (user 2).
These employees have access to the protected
part of the network. The problem is that the
access is from a public network so that the private
network must be able to distinguish
between different external users. The most common
protection is use of passwords, often combined
with call-back facilities. Call-back is used
as a simple means of authenticating the user.
First the user accesses the data system and identifies
himself. He then clears the connection and
the system is calling the user back in accordance
with stored address information. As the number
of users increases, the likelihood of poor passwords
also increases and it becomes easier to
penetrate the protected sectors. It has also been
reported that the security of call-back systems
is not always strong enough. During the last couple
of years, smartcards have been developed for
cryptographic authentication of the remote users.
This improves the protection radically.
One security threat of this type is concerned with
the TCP ports that direct the information contained
in the TCP package to the computer program
that is capable of interpreting and servicing
the content. There are ports for file transfer,
HTTP, e-mail, TELNET, a variety of test services,
and whichever other communication protocol
and communication service the network
supports. The TCP ports offer a primitive binding
service between communication peers. Altogether
it is possible to define 130,000 ports.
B
2
C
Telektronikk 1.2003