DCN Unit V
DCN Unit V
TRANSPORT LAYER
Transport layer the need for process-to-process delivery. The Internet model has three protocols at the transport layer: UDP, TCP,
and SCTP. First we discuss UDP, which is the simplest of the three. We see how we can use this very simple transport layer
protocol that lacks some of the features of the other two. We then discuss TCP, a complex transport layer protocol. We finally
discuss SCTP, the new transport layer protocol that is designed for multi homed , multi stream applications such as multimedia.
UDP
UDP provides connectionless, unreliable, datagram service. Connectionless service means that there is no logical connection
between the two ends exchanging messages. Each message is an independent entity encapsulated in a datagram.
UDP does not see any relation (connection) between consequent datagram coming from the same source and going to the same
destination.
UDP has an advantage: it is message-oriented. It gives boundaries to the messages exchanged. An application program may be
designed to use UDP if it is sending small messages and the simplicity and speed is more important for the application than
reliability.
User Datagram
UDP packets, called user datagram, have a fixed-size header of 8 bytes made of four fields, each of 2 bytes (16 bits).
. The 16 bits can define a total length of 0 to 65,535 bytes. However, the total length needs to be less because a UDP user datagram
is stored in an IP datagram with the total length of 65,535 bytes. The last field can carry the optional checksum
UDP Services
Process-to-Process Communication.
Connectionless Services
Flow Control
UDP is a very simple protocol. There is no flow control’
Error Control
There is no error control mechanism in UDP except for the checksum.
Checksum
UDP checksum calculation includes three sections: a pseudo header, the UDP header, and the data coming from the application
layer. The pseudo header is the part of the header of the IP packet in which the user datagram is to be encapsulated with some fields
filled with 0s
Typical Applications
The following shows some typical applications that can benefit more from the services of UDP
1.UDP is suitable for a process that requires simple request-response communication with little concern for flow and error control
2.UDP is suitable for a process with internal flow- and error-control mechanisms. For example, the Trivial File Transfer Protocol
(TFIP)
3.UDP is a suitable transport protocol for multicasting. Multicasting capability is embedded in the UDP software
4.UDP is used for management processes such as SNMP
5.UDP is used for some route updating protocols such as Routing Information Protocol (RIP)
6.UDP is normally used for interactive real-time applications that cannot tolerate uneven delay between sections of a received
message
TCP Services:
Process-to-Process Communication
Stream Delivery Service
Segments
Full-Duplex Communication
Reliable Service
Format:
The segment consists of a header of 20 to 60 bytes, followed by data from the application program.The header is 20 bytes if there
are no options and up to 60 bytes if it contains options.
Source port address This is a 16-bit field that defines the port number of the application program in the host that is sending the
segment.
Destination port address This is a 16-bit field that defines the port number of the application program in the host that is receiving
the segment.
Sequence number This 32-bit field defines the number assigned to the first byte of data contained in this segment.
Acknowledgment number This 32-bit field defines the byte number that the receiver of the segment is expecting to receive from
the other party.
Header length This 4-bit field indicates the number of 4-byte words in the TCP header. The length of the header can be between
20 and 60 bytes.
Reserved. This is a 6-bit field reserved for future use.
Control. This field defines 6 different control bits or flags as shown in Figure .One or more of these bits can be set at a time.
URG: Urgent pointer is valid
ACK: Acknowledgment is valid
PSH: Request for push
RST: Reset the connection
SYN: Synchronize sequence numbers
FIN: Terminate the connection
Window size. The length of this field is 16 bits, which means that the maximum size of the window is 65,535 bytes.
Checksum. This 16-bit field contains the checksum. The calculation of the checksum for TCP follows the same procedure as the
one described for UDP.
Urgent pointer. This l6-bit field, which is valid only if the urgent flag is set, is used when the segment contains urgent data.
Options. There can be up to 40 bytes of optional information in the TCP header.
TCP Features:
Numbering System
• Byte Number
• Sequence Number
• Acknowledgment Number
.
Flow Control
TCP, unlike UDP, provides flow control.
Error Control
To provide reliable service, TCP implements an error control mechanism.
Congestion Control
TCP, unlike UDP, takes into account congestion in the network.
A TCP Connection
TCP is connection-oriented. a connection-oriented transport protocol establishes a logical path between the source and
destination.
.
In TCP, connection-oriented transmission requires three phases: connection establishment, data transfer, and connection
termination.
Connection Establishment
TCP transmits data in full-duplex mode. When two TCPs in two machines are connected, they are able to send segments to each
other simultaneously.
Connection Termination
Any of the two parties involved in exchanging data (client or server) can close the connection ,although it is usually initiated by the
client. Most implementations today allow two options for connection termination: three-way handshaking.
ATM
Asynchronous Transfer Mode (ATM) is an International Telecommunication Union- Telecommunications Standards Section (ITU-
T) standard for cell relay wherein information for multiple service types, such as voice, video, or data, is conveyed in small, fixed-
size cells. ATM networks are connection-oriented. ATM technology has been implemented in a very broad range of networking
devices.
Benefits of ATM
Dynamic bandwidth for bursty traffic meeting application needs and delivering high utilization of networking
resources.
Smaller header with respect to the data to make the efficient use of bandwidth
Can handle Mixed network traffic very efficiently.
Cell network: All data is loaded into identical cells that can be transmitted with complete predictability and uniformity.
Class-of-service support for multimedia traffic allowing applications with varying throughput and latency requirements
to be met on a single network.
Scalability in speed and network size supporting link speeds of T1/E1 to OC–12 (622 Mbps).
Common LAN/WAN architecture allowing ATM to be used consistently from one desktop to another.
International standards compliance in central-office and customer-premises environments allowing for multivendor
operation.
ATM NETWORKS :
Public ATM Network:
o Provided by public telecommunications carriers (e.g., AT&T, MCI WorldCom, and Sprint)
o Interconnects private ATM networks
o Interconnects remote non-ATM LANs
o Interconnects individual users
Private ATM Network:
o Owned by private organizations
o Interconnects low speed/shared medium LANs (e.g., Ethernet, Token Ring, FDDI) as a backbone network
o Interconnects individual users as the front-end LAN for high performance or multimedia applications
An ATM network consists of a set of ATM switches interconnected by point-to-point ATM links or interfaces. ATM switches
support two primary types of interfaces: UNI and NNI as shown in Fig. The UNI (User-Network Interface) connects ATM end
systems (such as hosts and routers) to an ATM switch. The NNI (Network-Network Interface) connects two ATM switches. UNI
and NNI can be further subdivided into public and private UNIs and NNIs.
Header Payload
5 bytes 48 bytes
The basic operation of an ATM switch is straightforward: The cell is received across a link with a known VPI/VCI value. The
switch looks up the connection value in a local translation table to determine the outgoing port (or ports) of the connection and the
new VPI/VCI value of the connection on that link.
The ATM reference model, as shown in Fig. 4.6.9, consists of the following planes, which span all layers:
ATM layer—Combined with the ATM adaptation layer, the ATM layer is roughly analogous to the data link layer of the
OSI reference model. The ATM layer is responsible for the simultaneous sharing of virtual circuits over a physical link
and passing cells through the ATM network. To do this, it uses the VPI and VCI information in the header of each ATM
cell.
ATM adaptation layer (AAL)—Combined with the ATM layer, the AAL is roughly analogous to the data link layer of
the OSI model. The AAL is responsible for isolating higher-layer protocols from the details of the ATM processes. The
adaptation layer prepares user data for conversion into cells and segments the data into 48-byte cell payloads.
Higher Layer: Finally, the higher layers residing above the AAL accept user data, arrange it into packets, and hand it to
the AAL.
ATM Applications
In this lesson we shall discuss various cryptography algorithms, which can be divided into two broad categorize - Symmetric key
cryptography and Public key cryptography.
Symmetric key cryptography algorithms are simple requiring lesser execution time. As a consequence, these are commonly used
for long messages. However, these algorithms suffer from the following limitations:
Requirement of large number of unique keys. For example for n users the number of keys required is n(n-1)/2.
Distribution of keys among the users in a secured manner is difficult. Figure .
Traditional Symmetric Key ciphers : Two types:substitution, Transpositional Cipher .Substitution again divided into two types:
Monoalphabetic Substitution , Polyalphabetic Substitution
Monoalphabetic Substitution
As shown in Fig. in this approach a character in the ciphertext is substituted by another character shifted by three places, e.g. A is
substituted by D. Key feature of this approach is that it is very simple but the code can be attacked very easily.
Polyalphabetic Substitution
This is an improvement over the Caesar cipher. Here the relationship between a character in the plaintext and a character in the
ciphertext is always one-to-many. Key feature of this approach is that it is more complex and the code is harder to attack
successfully.
Transpositional Cipher
The transpositional cipher, the characters remain unchanged but their positions are changed to create the ciphertext. Figure
illustrates how five lines of a text get modified using transpositional cipher.
Initial XOR operation followed by 10 rounds .The last round is slightly different from preceding rounds ,it is missing one
operation. structure each round as shown in figure.
Structure Each Round
Advantages:
The pair of keys can be used with any other entity
The number of keys required is small
Disadvantages:
It is not efficient for long messages
Association between an entity and its public key must be verified
RSA
The most popular public-key algorithm is the RSA (named after their inventors Rivest, Shamir and Adleman) as shown in Fig. Key
features of the RSA algorithm are given below:
Public key algorithm that performs encryption as well as decryption based on number theory
Variable key length; long for enhanced security and short for efficiency (typical 512 bytes)
Variable block size, smaller than the key length
The private key is a pair of numbers (d, n) and the public key is also a pair of numbers (e, n)
Choose two large primes p and q (typically around 256 bits)
Compute n = p x q and z = (p-1)x(q-1)
Choose a number e
Find d such that e x d =1 mod (p-1)x(q-1)
e and n to the public; Z and d secret.
For encryption: C = Pe (mod n) For decryption: P = Cd (mod n)
--------------------------------------
K=gXY mod p
Step 1: Alice chooses a large random number x and calculates R1=gx mod p.
Step 2: Bob chooses another large random number y and calculates R2 = gY mod p.
Step 3: Alice sends R1 to Bob. Note that Alice does not send the value of x; she sends only R1-
Step 4: Bob sends R2 to Alice. Again, note that Bob does not send the value of y,he sends only R2.
Step 5: Alice calculates K = (R2)X mod p.
Step 6: Bob also calculates K = (R1)Y mod p.
The symmetric key for the session is K.
(gx mod p)Y mod p =(gY mod p)X mod p =gxy mod p
Network security:
Network security can provide one of the five services Four of these services are related to the message exchanged using the
network:
• message confidentiality
• Integrity
• Authentication
• no repudiation.
• The fifth service provides entity authentication or identification
Message Confidentiality
Message confidentiality or privacy means that the sender and the receiver expect confidentiality. The transmitted message must
make sense to only the intended receiver. To all others, the message must be garbage. When a customer communicates with her
bank, she expects that the communication is totally confidential.
Confidentiality with Symmetric-Key
Confidentiality with Asymmetric-Key Cryptography
To provide confidentiality with symmetric-key cryptography, a sender and a receiver need to share a secret key. In the past
when data exchange was between two specific persons , it was possible to personally exchange the secret keys.
The problem we mentioned about key exchange in symmetric-key cryptography for privacy culminated in the creation of
asymmetric-key cryptography. Here, there is no key sharing; there is a public announcement.
Message Integrity
Message integrity means that the data must arrive at the receiver exactly as they were sent. There must be no changes during the
transmission, neither accidentally nor maliciously.
There One way to preserve the integrity of a document was traditionally through the use of a fingerprint.
The electronic equivalent of the document and fingerprint pair is the message and digest pair.
To preserve the integrity of a message, the message is passed through an algorithm called a cryptographic hash
function.
The function creates a compressed image of the message that can be used like a fingerprint. Figure 16.8 shows the
message, cryptographic hash function and message digest.
• The message digest is created at the sender site and is sent with the message to the receiver. To check the integrity of a
message, or document, the receiver creates the hash function again and compares the new message digest with the one
received. If both are the same, the receiver is sure that the original message has not been changed. Of course, we are
assuming that the digest has been sent secretly.
Message authentication:
Figure 16.8 Message and
Message authentication is a service beyond message integrity. In message authentication the receiver needs to be sure of the
digest
sender's identity and that an imposter has not sent the message.
A message digest guarantees the integrity of a message—it guarantees that the message has not been changed. A message digest,
however, does not authenticate the sender of the message. When Alice sends a message to Bob, Bob needs to know that the
message is really from Alice. To provide message authentication, Alice needs to provide proof that it is she who is sending the
message and not an impostor. A message digest per se cannot provide such a proof. The digest created by a cryptographic hash
function is normally called a modification detection code (MDC). What we need for message authentication is a message
authentication code (MAC).
Digital signatures
We are all familiar with the concept of a signature. A person signs a document to show that it originated from him/her or was
approved by him/her. The signature is proof to the recipient that the document comes from the correct entity. In other words, a
signature on a document, when verified, isFigure 16.10
a sign of authentication—the document code
Message authentication is authentic. When Alice sends a message to
Bob, Bob needs to check the authenticity of the sender: he needs to be sure that the message comes from Alice and not Eve.
Bob can ask Alice to sign
16.34 the message electronically. In other words, an electronic signature can prove the authenticity of Alice
as the sender of the message. We refer to this type of signature as a digital signature.
Figure shows the digital signature process. The sender uses a signing algorithm to sign the message. The message and the
signature are sent to the recipient
The recipient receives the message and the signature and applies the verifying algorithm to the combination. If the result is
true, the message is accepted, otherwise it is rejected.
A digital signature provides three out of our initial five security services: message,authentication, message integrity and non-
repudiation. We have seen the first two, the third can be done using the following figure.
Entity Authentication
In entity authentication (or user identification) the entity or user is verified prior to access to the system resources (files, for
example). For example, a student who needs to access her university resources needs to be authenticated during the logging
process. This is to protect the interests of the university and the student.Entity authentication is a technique designed to let one
Figure 16.13 Non-repudiation using digital signatures
party prove the identity of another party. An entity can be a person, a process, a client or a server. The entity whose identity
needs 16.39
to be proved is called the claimant: the party that tries to prove the identity of the claimant is called the verifier.
Verification categories
In entity authentication, the claimant must identify themselves to the verifier. This can be done with one of three kinds of
witnesses:
Something known. This is a secret known only by the claimant that can be checked by the verifier. Examples are a
password, a PIN, a secret key and a private key.
Something possessed. This is something that can prove the claimant’s identity. Examples are a passport, a driver’s license,
an identification card and a credit card
Something inherent. This is an inherent characteristic of the claimant. Examples are conventional signatures, fingerprints,
voice, facial characteristics, retinal pattern and handwriting.
Quality of service (QoS) refers to any technology that manages data traffic to reduce packet loss, latency and jitter on the network.
QoS parameters:
Organizations can measure QoS quantitatively by using several parameters, including the following:
Packet loss happens when network links become congested and routers and switches start dropping packets. When packets are
Jitter is the result of network congestion, timing drift and route changes. Too much jitter can degrade the quality of voice and
video communication.
Latency is the time it takes a packet to travel from its source to its destination. Latency should be as close to zero as possible. If
a voice over IP call has a high amount of latency, it can experience echo and overlapping audio.
Bandwidth is the capacity of a network communications link to transmit the maximum amount of data from one point to
another in a given amount of time. QoS optimizes the network by managing bandwidth and setting priorities for applications
Mean opinion score (MOS) is a metric to rate voice quality that uses a five-point scale, with a five indicating the highest
quality.
Transport service primitives:
A service is specified by a set of primitives. A primitive means operation. To access the service a user process can access these
primitives. These primitives are different for connection oriented service and connectionless service.
There are five types of service primitives:
1. LISTEN : When a server is ready to accept an incoming connection it executes the LISTEN primitive. It blocks waiting
for an incoming connection.
2. CONNECT : It connects the server by establishing a connection. Response is awaited.
3. RECIEVE: Then the RECIEVE call blocks the server.
4. SEND : Then the client executes SEND primitive to transmit its request followed by the execution of RECIEVE to get the
reply. Send the message.
5. DISCONNECT : This primitive is used for terminating the connection. After this primitive one can’t send any message.
When the client sends DISCONNECT packet then the server also sends the DISCONNECT packet to acknowledge the
client. When the server package is received by client then the process is terminated.