<p>Den här rapporten beskriver en experimentell studie av Microsoft Network Protection (NAP) och är ämnad för att utvärdera hur mogen tekniken är för att implementeras i en aktiv nätverksmiljö. För att göra studien tog vi hjälp av gymnasieskolan John Bauer i Kalmar. Tester har utförts med DHCP-framtvingning och 802. 1x-framtvingning, dessa är två av NAPs fyra olika framtvingande funktioner. En mindre analys av skolans switchkonfigurationer och interna säkerhet har även gjorts på John Bauers begäran. Testerna har visat att DHCP-framtvingning är en bra och enkel lösning för John Bauers trådade klienter. NAP-funktionen 802. 1x- framtvingning var en större utmaning dock, och blev inte lyckad. Utbudet av information om NAP är än för knapphändig och vi anser därför att inte bara 802.1x framtvingning inte är redo för implementation, utan även framtvingning med DHCP.</p>

Den här rapporten beskriver en experimentell studie av Microsoft Network Protection (NAP) och är ämnad för att utvärdera hur mogen tekniken är för att implementeras i en aktiv nätverksmiljö. För att göra studien tog vi hjälp av gymnasieskolan John Bauer i Kalmar. Tester har utförts med DHCP-framtvingning och 802. 1x-framtvingning, dessa är två av NAPs fyra olika framtvingande funktioner. En mindre analys av skolans switchkonfigurationer och interna säkerhet har även gjorts på John Bauers begäran. Testerna har visat att DHCP-framtvingning är en bra och enkel lösning för John Bauers trådade klienter. NAP-funktionen 802. 1x- framtvingning var en större utmaning dock, och blev inte lyckad. Utbudet av information om NAP är än för knapphändig och vi anser därför att inte bara 802.1x framtvingning inte är redo för implementation, utan även framtvingning med DHCP.

<p>This thesis presents a comparative study of four Network Access Control (NAC) technologies; Trusted Network Connect by the Trusted Computing group, Juniper Networks, Inc.’s Unified Access Control, Microsoft Corp.’s Network Access Protection, and Cisco Systems Inc.’s Network Admission Control. NAC is a vision, which utilizes existing solutions and new technologies to provide assurance that any device connecting to a network policy domain is authenticated and is subject to the network’s policy enforcement. Non-compliant devices are isolated until they have been brought back to a complaint status. We compare the NAC technologies in terms of architectural and functional features they provide.</p><p>There is a race of NAC solutions in the marketplace, each claiming their own definition and terminology, making it difficult for customers to adopt such a solution, resulting in much uncertainty. The NAC paradigm can be classified into two categories: the first category embraces open standards; the second follows proprietary standards. By selecting these architectures, we cover a representative set of proprietary and open standards-based NAC technologies.</p><p>This study concludes that there is a great need for standardization and interoperability of NAC components and that the four major solution proposals that we studied fall short of the desired interoperability. With standards, customers have the choice to adopt solution components from different vendors, selecting, what is commonly referred to as the best of breed. One example for a standard technology that all four NAC technologies that we studied did adopt is the IEEE’s 802.1X port-based access control technology. It is used to control endpoint device access to the network.</p><p>One shortcoming that most NAC architectures (with the exception of Trusted Network Connect) have in common, is the lack of a strong root-of-trust. Without it, clients’ compliance measurements cannot be trusted by the policy server whose task is to assess each client’s policy compliance.</p>

This thesis presents a comparative study of four Network Access Control (NAC) technologies; Trusted Network Connect by the Trusted Computing group, Juniper Networks, Inc.’s Unified Access Control, Microsoft Corp.’s Network Access Protection, and Cisco Systems Inc.’s Network Admission Control. NAC is a vision, which utilizes existing solutions and new technologies to provide assurance that any device connecting to a network policy domain is authenticated and is subject to the network’s policy enforcement. Non-compliant devices are isolated until they have been brought back to a complaint status. We compare the NAC technologies in terms of architectural and functional features they provide. There is a race of NAC solutions in the marketplace, each claiming their own definition and terminology, making it difficult for customers to adopt such a solution, resulting in much uncertainty. The NAC paradigm can be classified into two categories: the first category embraces open standards; the second follows proprietary standards. By selecting these architectures, we cover a representative set of proprietary and open standards-based NAC technologies. This study concludes that there is a great need for standardization and interoperability of NAC components and that the four major solution proposals that we studied fall short of the desired interoperability. With standards, customers have the choice to adopt solution components from different vendors, selecting, what is commonly referred to as the best of breed. One example for a standard technology that all four NAC technologies that we studied did adopt is the IEEE’s 802.1X port-based access control technology. It is used to control endpoint device access to the network. One shortcoming that most NAC architectures (with the exception of Trusted Network Connect) have in common, is the lack of a strong root-of-trust. Without it, clients’ compliance measurements cannot be trusted by the policy server whose task is to assess each client’s policy compliance.

The sixth-generation (6G) of wireless communication systems will significantly rely on fog/edge network architectures for service provisioning. To satisfy stringent quality of service requirements using dynamically available resources at the edge, new network access schemes are needed. In this paper, we consider a cognitive dynamic edge/fog network where primary users (PUs) may temporarily share their resources and act as fog nodes for secondary users (SUs). We develop strategies for distributed dynamic fog probing so SUs can find out available connections to access the fog nodes. To handle the large-state space of the connectivity availability that includes availability of channels, computing resources, and fog nodes, and the partial observability of the states, we design a novel distributed Deep Q-learning Fog Probing (DQFP) algorithm. Our goal is to develop multi-user strategies for accessing fog nodes in a distributed manner without any centralized scheduling or message passing. By using cooperative and competitive utility functions, we analyze the impact of the multi-user dynamics on the connectivity availability and establish design principles for our DQFP algorithm.

O presente trabalho tem como pano de fundo a regulação de acesso a redes de telecomunicações e os problemas relacionados ao cumprimento das respectivas regras. A partir da descrição e conjugação de literaturas especializadas, a PRIMEIRA PARTE do texto delimita um conceito de estratégia regulatória, apontando seus elementos-chave as ferramentas e abordagens passíveis de escolha e combinações pelo regulador em suas tomadas de decisões , bem como as vantagens e desvantagens associadas a cada um deles. A SEGUNDA PARTE explora as características gerais do setor e da regulação das telecomunicações com vistas a facilitar a estruturação de um conceito de estratégia regulatória de compliance em regimes de acesso a redes. Na TERCEIRA PARTE o conceito proposto é aplicado ao caso brasileiro da regulamentação da EILD (Exploração Industrial de Linhas Dedicadas), uma modalidade de contratação de redes de operadores dominantes, como forma de identificar e avaliar criticamente as estratégias de compliance dos diferentes regimes de EILD já vigentes no país. Nesse processo são apontadas limitações das estratégias de compliance instituídas pelas normativas de EILD analisadas. Ainda nessa etapa o conceito proposto é aplicado a regimes internacionais de acesso a redes de telecomunicações, o que permite comparar a estratégia de compliance do atual regime brasileiro com as estratégias de compliance de regimes de acesso a redes de telecomunicações em países que também enfrentaram dificuldades para assegurar o cumprimento das regras de acesso. Conclui-se destacando a funcionalidade do uso do conceito para delimitação e análise das estratégias de compliance de regimes de acesso a redes de telecomunicações, o que auxilia o regulador em suas tomadas de decisão relacionadas à questão. / The thesis focuses on the regulation of telecom network access and the problems of compliance arising thereof. By describing and comparing some literature on the theme, PART ONE of the research defines a concept for regulatory strategy pointing out its main elements tools and approaches that might be selected and matched by the regulator , as well as the advantages and disadvantages related to it. PART TWO explores telecom´s sector and regulation basic features in order to facilitate the construction of a concept for compliance regulatory strategies applied to network access regimes. PART THREE presents a case study by means of which the proposed concept is applied to the regulation of leased lines (EILD) in Brazil a type of contracting network from dominant operators as a way to identify and discuss the compliance strategies of the different EILD regimes within the country. At this stage of the research some failures regarding the compliance strategies are underlined. Moreover the proposed concept is applied to international telecommunications network access regimes in a way to compare the compliance strategy within the current Brazilian access regime with the compliance strategies put in force by overseas regulators who faced many difficulties to deal with non-compliance problems. The conclusion underlines that the adoption of the proposed concept is helpful to identify and evaluate compliance strategies within the telecommunications network access regimes and therefore may facilitate the regulator task when deciding on the issue at hand.

O presente trabalho tem como pano de fundo a regulação de acesso a redes de telecomunicações e os problemas relacionados ao cumprimento das respectivas regras. A partir da descrição e conjugação de literaturas especializadas, a PRIMEIRA PARTE do texto delimita um conceito de estratégia regulatória, apontando seus elementos-chave as ferramentas e abordagens passíveis de escolha e combinações pelo regulador em suas tomadas de decisões , bem como as vantagens e desvantagens associadas a cada um deles. A SEGUNDA PARTE explora as características gerais do setor e da regulação das telecomunicações com vistas a facilitar a estruturação de um conceito de estratégia regulatória de compliance em regimes de acesso a redes. Na TERCEIRA PARTE o conceito proposto é aplicado ao caso brasileiro da regulamentação da EILD (Exploração Industrial de Linhas Dedicadas), uma modalidade de contratação de redes de operadores dominantes, como forma de identificar e avaliar criticamente as estratégias de compliance dos diferentes regimes de EILD já vigentes no país. Nesse processo são apontadas limitações das estratégias de compliance instituídas pelas normativas de EILD analisadas. Ainda nessa etapa o conceito proposto é aplicado a regimes internacionais de acesso a redes de telecomunicações, o que permite comparar a estratégia de compliance do atual regime brasileiro com as estratégias de compliance de regimes de acesso a redes de telecomunicações em países que também enfrentaram dificuldades para assegurar o cumprimento das regras de acesso. Conclui-se destacando a funcionalidade do uso do conceito para delimitação e análise das estratégias de compliance de regimes de acesso a redes de telecomunicações, o que auxilia o regulador em suas tomadas de decisão relacionadas à questão. / The thesis focuses on the regulation of telecom network access and the problems of compliance arising thereof. By describing and comparing some literature on the theme, PART ONE of the research defines a concept for regulatory strategy pointing out its main elements tools and approaches that might be selected and matched by the regulator , as well as the advantages and disadvantages related to it. PART TWO explores telecom´s sector and regulation basic features in order to facilitate the construction of a concept for compliance regulatory strategies applied to network access regimes. PART THREE presents a case study by means of which the proposed concept is applied to the regulation of leased lines (EILD) in Brazil a type of contracting network from dominant operators as a way to identify and discuss the compliance strategies of the different EILD regimes within the country. At this stage of the research some failures regarding the compliance strategies are underlined. Moreover the proposed concept is applied to international telecommunications network access regimes in a way to compare the compliance strategy within the current Brazilian access regime with the compliance strategies put in force by overseas regulators who faced many difficulties to deal with non-compliance problems. The conclusion underlines that the adoption of the proposed concept is helpful to identify and evaluate compliance strategies within the telecommunications network access regimes and therefore may facilitate the regulator task when deciding on the issue at hand.

Mémoire numérisé par la Division de la gestion de documents et des archives de l'Université de Montréal.

Esta tesis doctoral aborda el problema de la definición de movimientos rápidos sin interrupciones (seamless handoffs) en redes heterogéneas de próxima generación (NGNs) mediante definición de un proceso de distribución de claves seguro, que habilite un proceso de re-autenticación rápida a la vez que un acceso autenticado anónimo y que no se pueda trazar. Concretamente, el sistema de control de acceso desarrollado ofrece un conjunto de características que, hasta la fecha, no han confluido en una misma solución: (1) aplicable a las futuras redes NGN basadas en EAP; (2) reducción de la latencia introducida por el proceso de autenticación en entornos móviles, con independencia del tipo de handoff realizado por el usuario; (3) que el proceso cumpla fuertes requisitos de seguridad; (4) fácil despliegue en redes existentes; (5) compatibilidad con las actuales tecnologías estandarizadas; y (6) soporte de protección de privacidad del usuario. / This PhD thesis deals with the problem of defining fast movements without interruptions (seamless handoffs) in the next generation of heterogeneous networks. This objective is achieved through a secure key distribution process, which enables a fast re-authentication process providing both user anonymity and untraceability. The developed access control system offers a set of features not covered so far by a single solution: (1) applicable for EAP-based NGNs; (2) reduction of the authentication latency in mobile environments irrespective of the type of handoff performed by the user; (3) provision of strong security properties; (4) easy deployment in current networks; (5) compatibility with current standardized technologies; and (6) user privacy support.

Mémoire numérisé par la Division de la gestion de documents et des archives de l'Université de Montréal