Access Control Matrix
Review end user account request |
Approve end user account request |
Create end user account |
Audit end user accounts |
Review end user file server access request |
Approve end user file server access request |
Perform end user file server access change |
Audit end user file system permissions |
|
System Engineer 1 |
Yes |
|||||||
System Engineer 2 |
Yes |
Yes |
||||||
Network Administrator |
Yes |
Yes |
||||||
System Engineering Manager |
Yes |
Yes |
||||||
Security Administrator 1 |
Yes |
|||||||
Security Administrator 2 |
Yes |
Yes |
||||||
Security Manager |
Yes |
Yes |
||||||
IT Manager |
Yes |
The following URL is being followed for answering the questions on RFC 793 from the upcoming sections: https://tools.ietf.org/html/rfc793
The Tools.ietf.org5 (2017), states that TCP ensures reliability in Internet Protocol as transmission is made reliable via the following processes:
- Unique Sequencing – The TCP marks each packet with unique sequence number so as to keep track of all packets. This keeps track of which packets are lost in the transmission.
- Acknowledgements (ACK/NACK) – TCP has this mechanism to check whether every packet that was released from the transmission end has been received at the reception end. It does so with the help of a strict order of (ACK/NACK) acknowledgement/non-acknowledgement signals, and strict timeout windows.
- Timeout based retransmission – If the acknowledgement is not received before timeout, the octet or data packets are retransmitted (Wu et al., 2013).
- Damage Control – Damage is handled by the addition of a checksum to every transmitted segment, thus checking it at the receiver. This helps in discarding the damaged segments.
- Three-way handshake – The TCP uses the three-way handshake method to create a secure connection between the local host and the server. This method requires both the host and the server to exchange Synchronize (SYN) and Acknowledgement (ACK) packets before the actual communication is started.
- Error recovery – The TCP has the capability to recover from internet communication system errors (Kliazovich, Redana and Granelli, 2012).
An octet is known the unit of digital information. In telecommunications and computing, octet consists of eight bits. An octet’s value has its mathematical range from 0 to 255. However, a collection of related octets is known as an octet string. These are commonly found in IP (Internet Protocol) addressing, where 4-bytes of IPv4 addresses consist of 4 octets. In the dotted decimal notation, the IP address with octets is represented as below:
<octet> . <octet> . <octet> . <octet> for example, 292.238.0.1. However, the IPv6 contains 16 octets instead of 4. Octets are also capable of referring to individual byte units, within the network protocol’s headers and footers. Octets also help in the reliable transmission of data (Shacham et al., 2001).
In order to control the flow of data between the TCPs, the networking system employs a flow-control mechanism. As an acknowledgement, the receiving TCP reports a ‘window’ to the sending TCP. These windows specify the total number of octets that the receiving TCP is presently ready to receive. The window message starts with the acknowledgement number of the transmission as well. If the window size reported is zero, it means that the transmitting system needs to wait for an acknowledgment before it can send its next chunk of data. However, if the window reports a buffer size that is larger than the size of a single data packet, it depicts that the system can send multiple data packets without having to wait for the acknowledgement. This makes data transfer faster and more efficient (Tools.ietf.org5, 2017).
A full-duplex connection states that data can be transmitted in both directions, simultaneously. TCP establishes a full-duplex circuit between the transmitting hosts so that both can put data on the Internet simultaneously, without having to specify the destination host, once the connection is established. For example, in a LAN connection that is armed with the full duplex technology, a workstation may send data on the line while another is sending its data as well, at the same time. It is also known as a bi-directional type of communication system. These types of system are constituted of two channels. Each of which are responsible for transmitting data in their respectively opposite directions (Comer, 2015).
Flow Control Mechanism
The data communication system section form the RFC 793 defines the importance of the PUSH flag in the transmission of data packets. The SEND calls from the sending users carries the PUSH flag to denote if the data that it holds is to be sent to the receiver immediately. Setting of the PUSH flag will help in doing so. The sending TCP is meant to collect data as long as it does not encounter the PUSH flag. Then it has got to push send all its data to the receiver. Similarly, the receiver TCP will stop waiting for more data and push all its data to the receiver process. Even if the receiving process’ buffer is not filled, it must send through all its data into the receiving process on encountering the PUSH flag (Davidson, 2012).
In Tools.ietf.org6 (2017), the Nagle’s Algorithm, also known as nagling increases the efficiency of network systems by reducing the number of packets to be sent. The algorithm was initially designed to relive the private TCP/IP networks off the burden of congestion. Inserting two lines of code into a TCP program generally implements Nagle’s algorithm. The codes instruct the sender process to buffer data if there is a presence of unacknowledged data, outstanding. Data that is sent next, is held until the waiting data is acknowledged or until there is data to send, that is worth a full packet.
Therefore, the Nagle’s Algorithm aims at reducing the number of packets being sent. This improves the efficiency of the PUSH flag from RFC 793. This algorithm however emphasizes on the sender buffering its output until it is full.
To provide security and precedence to the TCP users, the TCP uses the Internet Protocol type of services and its security options. TCP modules that operate in the multilevel secured environment are needed to mark the outgoing segments with security, precedence and compartment tags. The levels of the same should also be mentioned to the users of the TCP. The methods mentioned here are still in use today. All users on the TCP/IP connection have their respective security label, which is associated with the IP address, defined on server. If users need a different security label, they must enter through an IP address having that particular security label (Tools.ietf.org5, 2017).
The concept of using sequence numbers is a major leap in TCP. Each octet that is sent over the TCP is assigned a specific sequence number. This helps the receiver to acknowledge each octet. This is a cumulative approach as it states that on acknowledging a sequence number-X, all the octets prior to that have been received.
Full-duplex Connection
This mechanism also helps in ruling out the possibilities of the presence of any duplicate octet. The sequence number space is not infinite, however it is large enough. The space ranges from 0 to (2^32-1). The space being finite makes the sequencing to be done based on the modulo of 2^32 (Tools.ietf.org5, 2017).
The TCP/IP network uses the three-way handshake method to create a connection between the local host and the server. This method requires both the host and the server to exchange Synchronize (SYN) and Acknowledgement (ACK) packets before the actual communication is started. The Three Way Handshake is also known as TCP-handshake. This method is necessary because the sequence numbers are not generally tied to the global clock on the network.
When an established connection is aborted or closed by one of the existing TCPs without the knowledge of the other, it is termed as a Half-Open connection. However, a scenario where both ends of a connection has gone desynchronized due to a crash and resulted in the loss of memory, it may also be termed as a half-opened connection (Rana, Garg, and Chamoli, 2012).
According to Tools.ietf.org3 (2017), TCP is the abbreviation for Transmission Control Protocol where as UDP stands for User Datagram Protocol. The primary difference between them is that TCP is a connection-oriented protocol, whereas UDP is connectionless. After setting up the connection, the TCP allows a bidirectional sending of data while in UDP, packets must be sent in chunks. UDP is faster than UDP; however, TCP is more reliable as compared to UDP. The UDP does not guarantee delivery and duplicate protection; therefore, it makes it less reliable. The TCP header size is 20 bytes whereas; the header size of UDP is 8 bytes.
The lack of policies to keep check over the duplication of data packets and to ensure data delivery makes the UDP RFC shorter than that of TCP’s. The UDP protocol assumes that the Internet Protocol is running as an underlying support and therefore it is necessary protocols are overlooked.
The RFC mentions that the UDP protocol is majorly used in the Trivial File Transfer mechanism and the Internet Name Server. However, since it is a faster mechanism, UDP has found its uses in the modern times as well. Media streaming, Gaming and Tunneling or VPN technologies uses this protocol vastly. These technologies do not care about the loss of data packets but the speed of transmission is all that matters. Therefore, its use is critical in this case (Shirmohammadi et al., 2015).
Nagle’s Algorithm
The author in the Tools.ietf.org4 (2017), states that the ICMP or the Internet Control Message Protocol is a supporting protocol integrated to the IP suite. Network devices use it in order to report error messages and other operational information. These control messages are needed to provide feedback about the issues in the communication environment . This does not make Internet Protocol reliable.
- Protect the network from old-style worms, which attempt to infiltrate using the echo request of the ICMP (Khule, Singh and Kulhare, 2014).
- The DoS (Denial of Service) attacks are generally based on ICMP (Anand and Patel, 2012).
The Avian Carriers is a high delay and low throughput method for the transmission of IP datagram, when compared to TCP. This method has a response time of approximately 3000 to 6000 seconds (Judge, 2013).
The Avian Carriers mechanism must ensure special security measures in the process of transmission of IP. The TCP model has multiple levels of security to make its data flow reliable, which is lacking in this method. The datagram sent over the Aviation Carriers must be encrypted, to rule out the risk of discovery by unwanted individuals in between the process. Moreover, the TCP ensures the delivery of packets through its various mechanisms where as this process cannot guarantee the same (Tools.ietf.org1, 2017).
The four types of documents or specifications that the author postulates through the International Monkey Protocol Suit (IMPS) are:
- KEEPER Specification- KIMP is the abbreviation for Knowledgeable and Efficient Emulation Protocol for Ecosystem Resources. The Zone Operations Organizations (ZOO) uses this in communicating with the Semi-Integrated, Monkey-Interfacing Anthropomorphic Node (SIMIAN). The ZOO sends requests to the SIMIAN using an IMPS packet. The SIMIAN then sends responses back to the ZOO with a different packet. KEEPER is a connectionless protocol. The IMPS protocol ID for this is 1.
- CHIMP Specification- The Cross-Habitat Idiomatic Message Protocol is used by the SIMIAN to communicate with the ZOO. The IMPS protocol ID for this is 2. This is meant to be a connection-oriented protocol where the client sends a series of requests to the server and waits for it to reply back.
- IAMB-PENT Specification- Inter-Annex Message Broadcasting Protocol for Evaluating Neoclassical Transcripts is the postulated specification that the ZOO uses in order to send transcripts to the Big Annex of Reference Documents (BARD). Its IMPS protocol number is 5. This too is a connection oriented protocol where the client sends transcript phrases to the server. The server further evaluates the transcript. It then notifies the client whether the received transcript matches to the classical work.
- PAN Specification- PAN stands for Protocol for Assessment of Novelty. The ZOO uses the PAN to send the monkey transcripts to the Collective Reviewer’s Innovative Transcript Integration Center (CRITIC) for review. The CRITIC being the all-powerful controller is sent requests from the ZOO and it further responds back. This too is connection oriented protocol. PAN’s IMPS protocol number is 10 (Tools.ietf.org2, 2017).
References
Anand, A. and Patel, B., 2012. An overview on intrusion detection system and types of attacks it can detect considering different protocols. International Journal of Advanced Research in Computer Science and Software Engineering, 2(8).
Comer, D., 2015. Computer networks and internets. Pearson.
Davidson, J., 2012. An introduction to TCP/IP. Springer Science & Business Media.
Judge, A., 2013. Circumventing Invasive Internet Surveillance with Carrier Pigeons.
Khule, M., Singh, M. and Kulhare, D., 2014. Enhanced worms detection by Netflow. International Journal of Engineering and Computer Science, 3(3), pp.5123-7.
Kliazovich, D., Redana, S. and Granelli, F., 2012. Cross?layer error recovery in wireless access networks: The ARQ proxy approach. International Journal of Communication Systems, 25(4), pp.461-477.
Rana, D.S., Garg, N. and Chamoli, S.K., 2012. A Study and Detection of TCP SYN Flood Attacks with IP spoofing and its Mitigations. International Journal of Computer Technology and Applications, 3(4).
Shacham, A., Thomas, M., Pereira, R. and Monsour, B., 2001. IP payload compression protocol (IPComp). Consultant.
Shirmohammadi, S., Abdallah, M., Ahmed, D.T., Lu, Y. and Snyatkov, A., 2015. Introduction to the special section on visual computing in the cloud: Cloud gaming and virtualization. IEEE Transactions on Circuits and Systems for Video Technology, 25(12), pp.1955-1959.
Tools.ietf.org1. (2017). RFC 1149 – User Datagram Protocol. [online] Available at: https://tools.ietf.org/html/rfc768 [Accessed 20 Nov. 2017].
Tools.ietf.org2. (2017). RFC 2795 – User Datagram Protocol. [online] Available at: https://tools.ietf.org/html/rfc768 [Accessed 20 Nov. 2017].
Tools.ietf.org3. (2017). RFC 768 – User Datagram Protocol. [online] Available at: https://tools.ietf.org/html/rfc768 [Accessed 20 Nov. 2017].
Tools.ietf.org4. (2017). RFC 792 – User Datagram Protocol. [online] Available at: https://tools.ietf.org/html/rfc768 [Accessed 20 Nov. 2017].
Tools.ietf.org5. (2017). RFC 793 – Transmission Control Protocol. [online] Available at: https://tools.ietf.org/html/rfc793 [Accessed 20 Nov. 2017].
Tools.ietf.org6. (2017). RFC 896 – User Datagram Protocol. [online] Available at: https://tools.ietf.org/html/rfc768 [Accessed 20 Nov. 2017].
Wu, H., Feng, Z., Guo, C. and Zhang, Y., 2013. ICTCP: Incast congestion control for TCP in data-center networks. IEEE/ACM transactions on networking, 21(2), pp.345-358.