System Architecture Design

pSHIELDSystem Architecture DesignPUIn the selected application framework of monitoring hazardous material transported via railway, thenecessity of a robust protection against malicious actions rises. Cryptography has been used for manyyears to provide security and information protection against different forms of attacks.In previous section, during Node layer description (6.1), some cryptographic algorithms and mechanisms,possibly implemented on the nodes, were introduced. 802.15.4, the communication standard of themajority of pSHIELD nodes, includes symmetric cryptography, to protect data payload. Versions ofAdvanced Encryption Standard (AES) can be realized on the nodes. Trusted Platform Module (TPM) isanother possible approach. However it should be noted that every algorithm appliance (accompanied bysoftware or hardware extras) on the nodes comes with the trade-off of increasing constraints, such ascost, size, memory and energy efficiency and therefore has to be dealt cautiously.6.2.6.2 IPsecSecurity and appliance of corresponding protocol suites in wireless networks can be realized in many (ifnot all) layers of OSI model. A reference to Internet Protocol Security (IPsec), which implements bothEncryption and Authentication in Network Layer, follows. IP should not be confused with Network Layer, ingeneral, since the former is an implementation (the most popular though) of the latter. IPsec is theprotocol suite for securing IP. It is an end-to-end scheme that can be used to protect sensible datatransfer between hosts or gateways. In other words, IPsec is the “interconnecting” security scheme.Connecting with the known protocols, it is worth referring that IPsec overcomes RADIUS vulnerabilityconcerning the latter’s lack of (per) packet authentication for access request packets. Originally designedfor IPv6 version of Internet Protocol, IPsec is one of the commonest protocols for securing, throughencryption, VPNs and in general remote accessing to private LANs. Another use concerns securing thepath between Access Point and Authentication Server, during the authentication stepped procedure of aclient’s request towards a wireless network. Often IPsec is adopted as a holistic solution for LANs andWLANs protection in the borders of an enterprise and there also lies its potential usefulness in pSHIELDnetwork. By doing so, the network designer replaces Layer 3 (Network, e.g. IP) with IPsec layer,emphasizing users’ identity and credentials against mere IP addresses. The advantage of the approachrests in the fact that the notion of “security” acquires a more hardware based dimension. For example,routers would be necessary to be employed to route based not only in IP addresses but on otherconnection characteristics, also (IPsec related associations).In the analysis of pSHIELD functional architecture, the notion and criticality of Security Agents wasillustrated. Being part of the pSHIELD Proxy component, Security Agent is charged with the aggregationof information from the pSHIELD Middleware Services and from other Security Agents connected on thesame Overlay, composing instances of pSHIELD subsystems to serve corresponding per demand needs.IPsec poses a strong candidacy as the network security mechanism foreseen for Security Agents. Theoverall security scheme would be again a composable one, maintaining the individual security protocols ofeach instance’s component, implementing simultaneously IPsec on top.6.2.6.3 SSLAlong with IPsec, SSL, being the predecessor of TLS (Transport Layer Security), is the most popularcryptographic protocol, for securing communications across the Internet. It is used mostly to protect HTTPtransactions, whereas other protocols concern IMAP (Internet Message Access Protocol) and POP3 (PostOffice Protocol) and applications as web browsing, electronic mail, Internet faxing, instant messaging andvoice-over-IP (VoIP). SSL uses asymmetric cryptography to encrypt network data above OSI’s TransportLayer. It is composed of the following protocols:1. Handshake protocol2. Change Cipher Spec protocolPUD2.3.2Issue 5 Page 100 of 122