08 Chapter8 Network Security.pptx

第1页：第9章：网络管理

第9章：网络管理

• introduction to network management
  • motivation
  • major components
• Internet network management framework
  • MIB: management information base
  • SMI: data definition language
  • SNMP: protocol for network management
  • security and administration
• presentation services: ASN.1

第2页：第9章路线图

第9章路线图

• What is network management?
• Internet-standard management framework
  • Structure of Management Information: SMI
  • Management Information Base: MIB
  • SNMP Protocol Operations and Transport Mappings
  • Security and Administration
• ASN.1

第3页：什么网络管理

什么网络管理

• autonomous systems (aka “network”):100 s or 1000 sof inter acting hardware/software components
• other complex systems requiring monitoring, control:
  • jet airplane
  • nuclear power plant
  • others?"Network management includes the deployment, integrationand coordination of the hardware, software, and human elements to monitor, test, poll, configure, analyze, evaluate,and control the network and element resources to meet thereal-time, operational performance, and Quality of Service requirements at a reasonable cost."

第4页：基础设施面向网络管理

基础设施面向网络管理

Infrastructure for network managementagentdataagentdataagentdataagentdatamanaged devicemanaged devicemanaged devicemanaged deviceman aging entitydata network management protocol definitions:managed devicescontainmanaged objectswhosedata is gathered into a Management Information Base (MIB)managing entity

第5页：网络管理标准 OSI CMIP

网络管理标准 OSI CMIP

• Common Management Information Protocol
• designed 1980’s:theunifying netmanagement standard
• too slowly standardized SNMP: Simple Network Management Protocol
• Internet roots (SGMP)
• started simple
• deployed, adopted rapidly
• growth: size, complexity
• currently: SNMP V3
• de facto network management standard

第6页：第9章路线图

第9章路线图

• What is network management?
• Internet-standard management framework
  • Structure of Management Information: SMI
  • Management Information Base: MIB
  • SNMP Protocol Operations and Transport Mappings
  • Security and Administration
• ASN.1

第7页：SNMP overview: 4 key parts

SNMP overview: 4 key parts

• Management information base (MIB):
  • distributed information store of network management data
• Structure of Management Information (SMI):
  • data definition language for MIB objects
• SNMP protocol
  • convey manager<->managed object info, commands
• security, administration capabilities
  • major addition in SNMPv 3

第8页：SMI: data definition language Purpose

SMI: data definition language Purpose

• base data types:
  • straightforward, boring
• OBJECT-TYPE
  • data type, status,semantics of managed object
• MODULE-IDENTITY
  • groups related objectsinto MIB module Basic Data Types INTEGER Integer 32 Unsigned 32OCTET STRING OBJECT IDENTIFIEDIP address Counter 32 Counter 64 Guage 32 Time Ticks Opaque

第9页：SNMP MIB

SNMP MIB

SNMP MIBOBJECT TYPE:OBJECT TYPE:OBJECT TYPE:objects specified via SMIOBJECT-TYPEconstruct MIB module specified via SMIMODULE-IDENTITY(100 standardized MIBs, more vendor-specific)MODULE

第10页：SMI: Object, module examples

SMI: Object, module examples

SMI: Object, module examples OBJECT-TYPE:ip In Delivers MODULE-IDENTITY:ip MIBip In Delivers OBJECT TYPESYNTAX Counter 32MAX-ACCESS read-only STATUS current DESCRIPTION“The total number of inputdatagrams success fully delivered to IP user-protocols (including ICMP)”::= { ip 9}ip MIB MODULE-IDENTITYLAST-UPDATED “941101000Z”ORGANZATION “IETF SNPv 2 Working Group”CONTACT-INFO“ Keith Mc Cloghrie……”DESCRIPTION“The MIB module for managing IPand ICMP implementations, butexcluding their management of IP routes.”REVISION “019331000Z”………::= {mib-2 48}

第11页：MIB 示例 UDP 模块对象标识

MIB示例：UDP模块：下表列出相关数据。

说明：源文件该页的 UDInErrors 拼写与 RFC 1213 中的 UDPInErrors 不一致，此处按源文件原文保留。

第12页：SNMP

SNMP

• hierarchical naming of all objects
• each branch point has name, number 1.3.6.1.2.1.7.1ISOISO-ident. Org. US Do DInternetudp In Datagrams UDPMIB2 management

第13页：OSI对象标识符树参考

OSI对象标识符树参考

Check outwww.alvestrand.no/harald/objectid/top.html OSIObject Identifier Tree

第14页：SNMP protocol Two ways convey

SNMP protocol Two ways convey

SNMP protocol Two ways to convey MIB info, commands:agentdata Managed deviceman aging entity response agentdata Managed devicemanagingentitytrap msgrequestrequest/response modetrap mode

第15页：SNMP 协议报文类型 Get 请求

SNMP 协议报文类型 Get 请求

SNMP protocol: message types Get Request Get Next Request Get Bulk Request Mgr-to-agent: “get me data”(instance,next in list, block)Message type Function Inform Request Mgr-to-Mgr: here’s MIB value Set Request Mgr-to-agent: set MIB value Response Agent-to-mgr: value, response to Request Trap Agent-to-mgr: inform managerof exceptional event

第16页：SNMP protocol: message formats

SNMP protocol: message formats

SNMP protocol: message formats

第17页：SNMP security and administration

SNMP security and administration

• encryption:DES-encrypt SNMP message
• authentication:compute, send MIC(m,k):compute hash (MIC) over message (m),secret shared key (k)
• protection against playback:use nonce
• view-based access control
  • SNMP entity maintains database of access rights, policies for various users
  • database itself accessible as managed object!

第18页：第9章路线图

第9章路线图

• What is network management?
• Internet-standard management framework
  • Structure of Management Information: SMI
  • Management Information Base: MIB
  • SNMP Protocol Operations and Transport Mappings
  • Security and Administration
• The presentation problem: ASN.1

第19页：presentation problem Q:does perfect

presentation problem Q:does perfect

The presentation problem Q:does perfect memory-to-memory copysolve “the communication problem”?A:not always!problem:different data format, storage conventionsstruct {char code;int x;} test;test.x = 256;test.code=‘a’a 0000000100000011 a 0000001100000001 test.codetest.xtest.codetest.xhost 1 formathost 2 format

第20页：表示问题的现实例子

表示问题的现实例子

A real-life presentation problem:aging 60’shippie 2007 teenager grandma

第21页：Presentation problem: potential

Presentation problem: potential

• real-world analogy?
• pros and cons?2. Sender sends. Receiver learns sender’s format. Receiver translate into receiver-local format
• real-world-analogy
• pros and cons?3. Sender translates host-independent format. Sends. Receiver translates to receiver-local format.
• real-world analogy?
• pros and cons?

第22页：Solving presentation problem 1

Solving presentation problem 1

Solving the presentation problem 1. Translate local-host format to host-independent format 2. Transmit data in host-independent format 3. Translate host-independent format to remote-host format aging 60’shippie 2007 teenager grandma

第23页：ASN.1抽象语法表示法1

ASN.1抽象语法表示法1

• ISO standard X.680
  • used extensively in Internet
  • like eating vegetables, knowing this “good for you”!
• defined data types, object constructors
  • like SMI
• BER: Basic Encoding Rules
  • specify how ASN.1-defined data objects to betransmitted
  • each transmitted object has Type, Length, Value(TLV) encoding

第24页：TLV Encoding Idea:transmitted data

TLV Encoding Idea:transmitted data

• T:data type, one of ASN.1-defined types
• L:length of data in bytes
• V:value of data, encoded according to ASN.1 standard 1234569 Boolean Integer Bitstring Octet string Null Object Identifier Real Tag Value Type

第25页：TLVencoding:example Value, 5 octets

TLVencoding:example Value, 5 octets

TLVencoding:example Value, 5 octets (chars)Length, 5 bytes Type=4, octet string Value, 259 Length, 2 bytes Type=2, integer

第26页：网络管理小结

网络管理小结

• network management
  • extremely important: 80% of network “cost”
  • ASN.1 for data description
  • SNMP protocol as a tool for conveying information
• Network management: more art than science
  • what to measure/monitor
  • how to respond to failures?
  • alarm correlation/filtering?