ZyXEL Communications PLA-470 V2 - V3.0.5 Guía de instalación descargar pdf (Pagina 99)

We notice that this technique requires too much time to be used efficiently.

Denial of Service Attacks

The purpose of an attack is not necessarily to crack an encryption algorithm

to recover the key and listen to the network or get into it. The single purpose of

some attacks is to sabotage the network by preventing it from operating. This

type of attack, called denial of service, or DoS, is widespread for all network

types.

In PLC networks, the simplest denial of service corresponds to scrambling. Since

these networks operate in the 1- to 30-MHz frequency band, the use of a radio unit

using the same band with a power greater than PLC power can cause interference

and, consequently, a global performance drop; it can even completely prevent the

network from operating. This attack is the simplest to implement. Unfortunately, it

is also unmanageable.

IEEE 802.1x and Improvements to PLC Network Security

IEEE 802.1x is an authentication architecture proposed by the IEEE committee

802. This is not in any case whatsoever a completely separate protocol but these

are guidelines used to define the various functionalities that are necessary to

implement a client authentication service on any type of local area network

(Ethernet, PLC).

The 802.1x architecture, called port-based network access control, is based on

two key elements, the EAP and RADIUS protocols.

The port is an important element of this authentication architecture. The port

defines any type of attachment to a local area network infrastructure. In PLC, like in

Ethernet, the connection of two machines is considered as a port.

The 802.1x architecture is illustrated in Figure 4.13. It consists of the three fol-

lowing distinct elements:

•

a client corresponding to the user who would like to connect to the network

via his or her station;

•

a controller, generally a switch or a router, relaying and controlling the infor-

mation between any requester and the authentication server;

•

an authentication server authenticating the user.

For each port, the network traffic can be controlled or not. Between the client

and the controller, the port is controlled so that only EAP authentication messages

of the request-response type are transmitted. Any other type of traffic is rejected. On

the contrary, between the controller and the authentication server, any type of traf-

fic is accepted since the medium is supposedly secure.

In 802.1x, the authentication is based on the EAP (extensible authentication

protocol) and the use of a RADIUS (remote authentication dial-in user service)

server.

80 Security

1 2 ... 94 95 96 97 98 99 100 101 102 103 104 ... 348 349

Sin comentarios

ZyXEL Communications PLA-470 V2 - V3.0.5 Guía de instalación Pagina 99