- Book Chapter
- 10.1016/b978-193183663-0/50040-2
Chapter 5 - Configuring Authentication, Authorization, and Accounting
- Jan 01, 2002
- Cisco Security Specialists Guide to PIX Firewall
Chapter 5 - Configuring Authentication, Authorization, and Accounting
The end of IPv4 addresses is now a reality. Providers not updated to IPv6 will have to hurry up the IPv6 start in its own network. Introduction of IPv6 means not only change of main routers but also change of mentality in operators, applications’ programmers besides end users. Even when for the last years the core network is prepared for transferring IPv6 traffic, other built-in parts of the Internet limit the IPv6 start. Examples of these limitations we find in not IPv6-awareness of many applications and services. For instance, voice over IP service, which uses session initiation protocol (SIP) needs to implement IPv6 aware SIP proxies and IPv6 aware AAA (authentication, authorization and accounting) servers as well as adapting application programming interfaces to IPv6. Internet protocol television (IPTV) system includes many different hardware devices, which not always are IPv6 compatible. In this paper, we propose a global solution for integrating all the devices, these one working on IPv4 and these one working on IPv6, under the same IPTV platform. This solution allows end users to receive IPTV stream irrespective of IP protocol used. The proposed solution is particularly relevant for small IPTV systems, which, step by step, are adapting into IPv6.
Chapter 5 - Configuring Authentication, Authorization, and Accounting
Chapter 5 - Configuring Authentication, Authorization, and Accounting
A batch rekeying time decision algorithm for IPTV systems
This paper proposes an algorithm to decide on the batch rekeying time for group key management schemes for Internet protocol television (IPTV) systems. Batch rekeying schemes can reduce the effect of membership changes in group key management schemes by collecting and processing several join and leave events at once. Because membership of IPTV systems frequently changes due to the frequent changes of TV channels viewed by subscribers, batch rekeying schemes are suitable to IPTV systems. Our algorithm considers one more factor; programs broadcasted on IPTV channels can have various values. By computing the expected loss from the value of programs, and the number and time of join and leave events, our algorithm decides on the next rekeying time where the expected loss becomes larger than the predefined loss value given by the service provider.
Read moreIntelligent IPTV Distribution for Smart Phones
Current advances in embedded hardware for mobile devices, jointly with new type of batteries that let smart phones have more power during longer periods of time, allow them to offer new services to customers. Internet Protocol Television (IPTV) is the Internet Protocol (IP) service that is experiencing highest demand. Many mobile telephone companies are adding this service to their supply. In this chapter, the authors show all steps to transmit the IPTV service from the provider to the smart phone. First, they introduce the current hardware and operating systems for smart phones. Then, they describe the main parts of the IPTV architecture and the main protocols used for IPTV transmission in order to show how it works. Next, the authors show where intelligent systems can be deployed in the IPTV network in order to provide better QoE (Quality of Experience) on the end-user side. Then, they discuss the limitations and requirements for IPTV reception on smart phones. Finally, the authors explain the IPTV implementation in smart phones and describe an IPTV player on Android.
Read moreA new bandwidth allocation for IPTV services over EPON
Internet Protocol Television (IPTV) is a service to present digital TV over Internet. The IPTV network architecture consists of two main components: core network and access network. Many types of access networks can be used for IPTV including Ethernet PON (EPON). In this paper, a new mechanism is proposed for bandwidth allocation to various IPTV services over the EPON that decreases IPTV packet loss. This mechanism is implemented in optical line terminal (OLT) and weights are allotted to queues in the OLT to reduce packet loss. Then, weighted round robin (WRR) is used to scheduling IPTV packets.
Read moreP2P-Based Home Monitoring System Architecture Using a Vacuum Robot with an IP Camera
We propose Peer-to-Peer-based (P2P-based) home monitoring system architecture to exploit a vacuum robot with an IP camera, a movable IP camera, without requiring a number of cameras for the whole monitoring at home. The key implementation issues for the proposed home monitoring system are (1) the easy configuration of a vacuum robot to connect to Wi-Fi networks, (2) the session management between a vacuum robot and a home monitoring server, and (3) the support of the Network Address Translator (NAT) traversal between a vacuum robot and a user terminal. In order to solve these issues, we use and extend the Wi-Fi Protected Setup (WPS), the Session Initiation Protocol (SIP), and the UDP hole punching. For easy configuration of a vacuum robot, we also propose the GENERATE method which is an extension to the SIP that allows for the generation of a SIP URI. In order to verify the feasibility of the proposed system, we have implemented the prototype and conducted the performance test using the authoritative call generator.
Read moreOn the QoS of IPTV and Its Effects on Home Networks
In Internet Protocol Television (IPTV) systems, Quality-of-Service (QoS) is a critical factor for user satisfaction. In this paper, we first propose a queueing model for IPTV systems and discuss how to ensure the QoS of IPTV. We then use the model to analyze the effects of IPTV traffic on other applications in home networks. We find that TCP congestion control may not work well under this circumstance and propose a new approach to improve the performance of TCP. We also verify our results throughns2simulations.
Read moreMeasurement of the SIP Parsing Performance in the SIP Express Router
Future telephony and multimedia systems will use the Session Initiation Protocol (SIP) for signaling purposes. SIP is a text-based protocol that imposes challenges for an efficient message processing. The ability of SIP entities to process SIP messages quickly is crucial for the performance of these networks, which often have strict timing requirements, e. g., to keep the call setup delays small. This paper studies the performance of SIP message processing in SIP proxies, focusing mainly on the impact of message parsing. We perform a detailed delay analysis for the widely used SIP Express Router (SER). Our measurements show that message parsing actually contributes significantly to a SIP proxy's processing efforts, and therefore confirm other existing studies. However, our results also show that the overall delay in high-performance SIP proxies is stronger affected by other factors, in particular the operating system.
Read moreArchitecture of SQL databases for WLAN access control and accounting
In recent years, there has been a growing demand for the development of authentication, authorization and accounting (AAA) systems for WLAN networks. In this paper we present a network architecture of SQL database servers especially tailored for AAA functions in large WLAN systems. Proposed database network architecture is vendor independent in sense that can be deployed with different AAA server implementations. WLAN management information database for AAA purposes is center of a WLAN network management system providing control of parameters such as: authentication and authorization of users, deletion or creation of users information, storage of accounting information which can be used for billing. Detailed database structure of each SQL database server in proposed centralized-distributed AAA database network architecture is described. Working principles of network database system for WLAN AAA purposes are based on MySQL master/slave chain replication. Proposed network architecture of SQL databases offers high level of reliability, availability and scalability.
Read moreReal-time air quality monitoring by using internet video surveillance camera
Nowadays internet video surveillance cameras are widely use in security monitoring. The quantities of installations of these cameras also become more and more. This paper reports that the internet video surveillance cameras can be applied as a remote sensor for monitoring the concentrations of particulate matter less than 10 micron (PM10), so that real time air quality can be monitored at multi location simultaneously. An algorithm was developed based on the regression analysis of relationship between the measured reflectance components from a surface material and the atmosphere. This algorithm converts multispectral image pixel values acquired from these cameras into quantitative values of the concentrations of PM10. These computed PM10 values were compared to other standard values measured by a DustTrak<sup>TM</sup> meter. The correlation results showed that the newly develop algorithm produced a high degree of accuracy as indicated by high correlation coefficient (R<sup>2</sup>) and low root-mean-square-error (RMS) values. The preliminary results showed that the accuracy produced by this internet video surveillance camera is slightly better than that from the internet protocol (IP) camera. Basically the spatial resolution of images acquired by the IP camera was poorer compared to the internet video surveillance camera. This is because the images acquired by IP camera had been compressed and there was no compression for the images from the internet video surveillance camera.
Read moreSession scheduling in sip based network
Session Initiation Protocol (SIP) is a new signaling protocol used to establish and release sessions between end users. Using SIP over MPLS networks offers new possibilities to enhance network performance and QoS (Quality of Service) perceived by users. In this paper we evaluate a session level approach to enhance QoS in DiffServ domain. We implement scheduling mechanisms for TCP sessions based on mean rate, size and duration. Dynamic declassing of TCP sessions and bandwidth sharing with WFQ system are discussed and tested. These mechanisms are implemented in the SIP Proxy server of the SIP architecture.
Read moreVideo coding and delivery challenges for next generation IPTV
Current generation, large-scale, Internet protocol television (IPTV) systems borrow heavily from the broadcast industry, which makes a number of delivery assumptions that do not apply to IP networks. Consequently we can perceive major improvements if we better match the delivery of IPTV services with the underlying network transport. We can expect next generation IPTV systems to adapt video streams dynamically to maximise throughput, allow constant quality delivery, and degrade gracefully in congested networks. This paper outlines the challenges in optimising IPTV delivery and the contribution that BT’s research has made to overcoming some of these.
Read moreDiameter Network Address and Port Translation Control Application
This document describes the framework, messages, and procedures for the Diameter Network address and port translation Control Application. This Diameter application allows per-endpoint control of Network Address Translators and Network Address and Port Translators, which are added to networks to cope with IPv4 address space depletion. This Diameter application allows external devices to configure and manage a Network Address Translator device -- expanding the existing Diameter- based Authentication, Authorization, and Accounting (AAA) and policy control capabilities with a Network Address Translator and Network Address and Port Translator control component. These external devices can be network elements in the data plane such as a Network Access Server, or can be more centralized control plane devices such as AAA- servers. This Diameter application establishes a context to commonly identify and manage endpoints on a gateway or server and a Network Address Translator and Network Address and Port Translator device. This includes, for example, the control of the total number of Network Address Translator bindings allowed or the allocation of a specific Network Address Translator binding for a particular endpoint. In addition, it allows Network Address Translator devices to provide information relevant to accounting purposes. [STANDARDS-TRACK]
Read moreImplementation of AAA Server for PMIPv6 in NS-2
Proxy Mobile IPv6 is a network-based mobility protocol where the mobility management signaling is performed by a network entity on behalf of the node requiring mobility itself. Mobile IPv6 (MIPv6) enables Mobile Node (MN) to maintain its connectivity to the Internet during handover. The Mobile Access Gateway (MAG), located in the access router, retrieves the MN profile information from Authentication, Authorization, and Accounting (AAA) server and sends the customized Router Advertisements to the MN, emulating the home network behavior. Theoretically there is an inclusion of AAA server in PMIPV6 but the practical inclusion is not been attempted yet, hence this paper proposes an architecture for including the AAA server into the NS2 for PMIPV6.
Read moreSupporting Interactive IPTV Apps with an Enterprise Resource Bus
Delivering TV services via internet protocols over high-speed connections is commonly referred to as IPTV (Internet Protocol TeleVision). A particularly interesting aspect of IPTV is the augmentation of the subscriber’s TV experience with interactive applications (apps). Due to the service-oriented infrastructure of many IPTV platforms it is fairly easy to integrate 3rd party services and expose them in form of IPTV apps. However, due to the very competitive market in which IPTV providers operate, they are forced to minimize their costs and thus avoid costly customer complaints. This in turn introduces the need for highly dependable IPTV apps/web services with minimal downtimes. This paper focuses on the development of dependable web services for IPTV. Using Brewer’s CAP theorem the paper investigates the role of state-management within web services and presents the idea of the Enterprise Resource Bus (ERB) and an evaluation of its Erlang implementation.
Read moreProviding Media Control to SIP-based IVR Applications: The IVRObject Approach
A popular application that runs on a Voice-over-IP network is the Interactive Voice Response (IVR), which provides a way for interacting with an end user's phone via a telephony interface by presenting a set of audible menu options, and collecting the user's Dual Tone Multi-Frequency responses as the user presses the telephone numeric keypad, and recording the user's voice. This thesis takes a closer look into IVR systems on an IP-based network, specifically in networks that support the Session Initiation Protocol (SIP) for controlling the telephony signalling, and more specifically on IVR systems that have their SIP signalling controlled by a SIP Application Server (SIPAS) implementing the SipServlet 1.0 or 1.1 specifications and where a SIP-based Media Server is used to stream IVR media to the end-user. We describe existing ways for supporting an IVR development in a SIP network, and then we propose an alternative way of accomplishing the same task: the IVRObject. With the help of prototypes, the IVRObject is compared with the existing state of the art against three criteria: a) how easy it is to develop, b) how portable the development solution is, c) and how scalable the solution is in order to sustain a high call volume. As a conclusion, it will be highlighted that the IVRObject provides an easy mechanism for development of IVR-based applications running on a SIP AS, that it is portable to different media server vendors, and that it supports a test strategy that can be leveraged to improve software development quality and faster development. This makes the IVRObject a good alternative especially for enterprise-based IVR applications where scalability is less of an issue than in carrier-space applications.
Read more