京都大学 / 0048 / 新制・課程博士 / 博士(情報学) / 甲第22589号 / 情博第726号 / 新制||情||124(附属図書館) / 京都大学大学院情報学研究科通信情報システム専攻 / (主査)教授 守倉 正博, 教授 原田 博司, 教授 大木 英司 / 学位規則第4条第1項該当 / Doctor of Informatics / Kyoto University / DFAM

This master thesis deals with all types of wireless networks security – in personal, local, metropolitan and also mobile networks. This work is mostly focused on wireless local area networks (WLANs), which are the most widespread at nowadays. This work describes attacks to the wireless local area network, attackers steps and possible protection against it. Some of these attacks are tested in practical part of this work. In this master thesis there were also designed and created two laboratory exercises. One of them is a simulation in the wireless network using Opnet Modeler application. The other exercise is strictly practical type.

Master´s thesis „Security risks of wireless access networks“ deals with wireless access networks, which are the most widespread in this time. The main target is realization of attacks wireless access networks protected by various using methods. This thesis shows main securities gaps, which originate from project this networks. These securities gaps are used for realization attacts in practical part. In the next part I took attention of network´s monitoring possibilities.

Imega Media/IT har planerat en uppgradering av nätverket inom företagets avdelning Display. Företagets planer är att ersätta ett föråldrat Cat5 Ethernetkablge med Cat6 för att uppnå en högre uppkopplingshastighet samt etablera ett lokalt nätverk för avdelningen. Denna rapport dokumenterar de steg som tagits för att analysera och på bästa sätt kunna implementera den planerade uppgraderingen, baserat på hårdvara och konfigurationskrav. Med en skiss över företagets nätverkstopologi kunde man konstatera att ingen sekundär väg existerade till de båda yttre switcharna, och därmed garantera att inga switchingloopar kunde uppstå när den slutgiltiga topologin kopplats samman. Baserat på detta ersattes kablage och ny hårdvara implementerades för ett nytt lokalt nätverk. Utförandet möjliggjorde för de anställda att kunna fortsätta sitt arbete utan driftstörningar. I slutändan kunde man med hjälp av enklare mätningar i form av filnedladdning, garantera att hastigheter uppemot 1 Gb/s kunde uppnås. / The company Imega Media/IT has planned an upgrade for the network within one of the company departments called Display. Hardware is implemented in order to establish a local network and replace the installed Cat5 Ethernet cables with the Cat6 version in order to achieve a higher connection speed. This report documents steps taken in order to analyze and in the best possible way implement the planned upgrade, based on offered hardware and configuration requirements. With the help of a sketch, covering the network topology, one could state that no secondary route existed towards the end switches, therefore guaranteeing that no switching loops could appear after the final installation. Based on the documented topology, improved Ethernet cabling and new hardware were implemented, establishing a new local network. Finally, by using existing hardware resources within the upgraded network, measurements could be made to guarantee that a gigabit speed was reached.

Many reports have been written about the techniques behind Virtual Private Networks (VPN) and Multi Protocol Label Switching (MPLS). They usually deal with the low level design of the software implementing a specific technique. The initial products are usually not mature enough to run in a large network or have to be adjusted in some way to fit. This report investigates the different ways of implementing strict layer 2 Virtual Private Networks in an existing nation-wide Gigabit Ethernet. The infrastructure in use, as well as the hardware, has to be used without major changes. Since 1998/1999, when MPLS first started in the laboratories, development has continued. Today it is possible to introduce MPLS or tunneled national virtual local area network into an existing network. This requires high speed, fault tolerant, and stable hardware and software. Going beyond the separation of traffic at layer 3 using Virtual Private Networks, i.e., IPSec, we can tunnel layer 2 traffic through a network. Although the first layer 3 VPN products are already in use, layer 2 VPNs still need to be evaluated and brought into regular use. There are currently two ways of tunneling VLANs in a core network: tunneled VLANs (or as Extreme Networks calls them, VMANs) and MPLS. This project showed that it is possible to start with a VLAN-only solution, and then upgrade to MPLS to solve scalability issues. The VMAN solution can not be used at Arrowhead, since there are too many disadvantages in the way Extreme Networks has implemented it. However, a mix of tunneling VMAN in a VLAN core is possible, and enables customer tagging of VLANs in a Layer 2 VPN. Furthermore, the testing of EAPS and per-VLAN Spanning Tree Protocol turned out well, and showed that EAPS should not be used when there is more than one loop.

No description available.

Objective. To study whether an electrosurgery device interferes with the operation of a low-power spread-spectrum wireless network adapter. Methods. Nonrandomized, unblinded trials with controls, conducted in the corridor of our institution's operating suite using two portable computers equipped with RoamAbout omnidirectional 250 mW spread-spectrum 928 MHz wireless network adapters. To simulate high power electrosurgery interference, a 100-watt continuous electrocoagulation arc was maintained five feet from the receiving adapter, while device reported signal to noise values were measured at 150 feet and 400 feet distance between the wireless-networked computers. At 150 feet range, and with continuous 100-watt electrocoagulation arc five feet from one computer, error-corrected local area net throughput was measured by sending and receiving a large file multiple times. Results. The reported signal to noise (N = 50) decreased with electrocoagulation from 36.42 ± 3.47 (control) to 31.85 ± 3.64 (electrocoagulation) (p < 0.001) at 400 feet inter-adapter distance, and from 64.53 ± 1.43 (control) to 60.12 ± 3.77 (electrocoagulation) (p < 0.001) at 150 feet inter-adapter distance. There was no statistically significant change in network throughput (average 93 kbyte/ second) at 150 feet inter-adapter distance, either transmitting or receiving during continuous 100 Watt electrocoagulation arc. Conclusions. The manufacturer indicates "acceptable" performance will be obtained with signal to noise values as low as 20. In view of this, while electrocoagulation affects this spread spectrum network adapter, the effects are small even at 400 feet. At a distance of 150 feet, no discernible effect on network communications was found, suggesting that if other obstructions are minimal, within a wide range on one floor of an operating suite, network communications may be maintained using the technology of this wireless spread spectrum network adapter. The impact of such adapters on cardiac pacemakers should be studied. Wireless spread spectrum network adapters are an attractive technology for mobile computer communications in the operating room.

No description available.

<p>Syftet med den här rapporten är att beskriva ett antal olika tillvägagångssätt man kan använda sig av då man har behov av att dela in ett lokalt nätverk i olika segment och med det även kunna reglera trafikflödet mellan segmenten. De lösningar som presenteras i arbetet är inriktade mot mikro- och småföretag.Anledningen till att vi har valt att arbeta med det här området är att vi anser att det är viktigt för organisationer att har en strukturerad och segmenterad design på sitt interna datornätverk.Vi har arbetat genom att i förväg samla in information om olika tekniker som kan tänkas lösa vårt problem, och därefter testat olika scenarion med dessa tekniker. Data har samlats in efter varje genomfört scenario och sammanställts i statistisk form för att kunna avgöra vilken metod som var att föredra.Vi har testat lösningar där man segmenterar nätverket i en lager 2-switch medan man möjliggör och förhindrar trafikflöde mellan segmenten i en router. Även lösningar där man använder en lager 3-switch har testats. På så sätt kan routningen ske direkt i switchen och det blir betydligt mindre belastning i routern. Resultatet visar att då man vill segmentera ett nätverk så är det rekommenderat att man använder sig av VLAN och ACL:er och eventuellt i kombination med en brandvägg.Slutresultatet av rapporten är att en lösning med ”router on a stick” är den billigaste lösningen och troligen den som de flesta mindre företag skulle klara sig med. Vilken lösning man väljer beror dock helt på hur mycket pengar man vill lägga på sitt nätverk samt vad kraven är.</p> / <p>The purpose of this report is to describe a number of approaches that can be used when you are in need of dividing a local area network in a number of segments, and with that also be able to control how data traffic is allowed to traverse between the different segments. The solutions that are presented are focused towards micro and small companies.The reason that we have chosen to work with this matter is that we believe it is important for organizations to have a structured and segmented design of its internal computer network.We have been working by in advance collecting information about various techniques that might solve our problem, and then testing different scenarios using these techniques. Data have been collected after each tested scenario and compiled in statistical form in order to determine which method that was preferable.We have been testing solutions were you segment the network in a layer 2 switch while you allow or deny communication between the segments in a router, and also solutions were you use a layer 3 switch. In that way you can let the routing be performed in the switch, which leads to significantly lower load on the router. The result was that if you are about to segment a local area network it is recommended that you use VLAN and ACL:s, and possibly in combination with a firewall.The final result of this report is that a solution using the “router on a stick”-technique is the cheapest one, and probably the one that most small companies would get along with. However, the solution that you choose depends completely on how much money you want to spend on your network, and also what the needs are.</p>

O desenvolvimento e utilização do padrão IEC 61850 alterou a concepção e operação das subestações de energia elétrica. O desempenho e confiabilidade do sistema de proteção depende da rede de comunicação de dados. Esta pesquisa propõe um parâmetro de dimensionamento e comparação de desempenho para o tempo de transferência das mensagens Generic Object Oriented Substation Event (GOOSE) entre Intelligent Electronic Devices (IEDs). Esse parâmetro foi obtido através do levantamento experimental da curva do tempo de transferência das mensagens GOOSE versus a ocupação percentual da largura de banda dos IEDs. Para a realização dos experimentos foram utilizados três IEDs, um switch Ethernet gerenciável, três microcomputadores do tipo PC, um relógio sincronizador Global Positioning System (GPS), cordões de fibra óptica, cabos do tipo par trançado sem blindagem e aplicativos de software. Os resultados mostraram que a partir de um limiar característico, o qual é distinto para cada IED ensaiado, o tempo de transferência excede o limite máximo permitido pelo padrão IEC 61850. A partir da análise destes dados, foi desenvolvido um sistema preditivo de monitoramento de banda para supervisionar a interface de rede dos IEDs. O sistema preditivo apresentou para a medição de banda um erro relativo médio igual a 0,55% em relação ao aplicativo comercial utilizado na comparação, já a predição feita pela rede neural artificial apresentou um erro de estimativa menor do que 3% para 91,30% das amostras utilizadas, além de modelar adequadamente o comportamento da série temporal que representa a ocupação de banda do IED monitorado. / The development and utilization of IEC 61850 standard changed the design and operation of electric power substations. The performance and reliability of the protection system depends on the data communication network. This research proposes a parameter for dimensioning and comparising the transfer time of Generic Object Oriented Substation Event (GOOSE) messages between different Intelligent Electronic Devices (IEDs). This parameter was obtained from experimental data related to the transfer time of GOOSE messages curve versus IEDs bandwidth percentage occupation. In this context, a laboratory structure was set up in order to carry out these experiments. This structure mainly consists of three IEDs, an Ethernet switch, three personal computers, a GPS Clock, fiber optic cables, unshielded twisted pair cables, as well as support software. The results show the existence of a characteristic threshold, different for each IED tested, after which the transfer time exceeded the total transmission time allowed for the IEC 61850 standard. Based on these results, a predictive bandwidth monitoring system was developed to supervise the IEDs bandwidth interface. The bandwidth measurement has a mean relative error of 0.55% regarding to the commercial software used for comparison. Finally, the forecasting made by the artificial neural network has a relative error of 3% for 91,30% of the samples used in test phase. In addition, that it was able to model the behaviour of the time series that represent the bandwidth occupation.