Forum ponders ATM security

By Stephen Lawton 

Next week The ATM Forum is due to vote on its first omnibus security standard in an attempt to address the interoperability concerns of IS managers with investments in the cell-switching technology.

Key components of the security draft address specifics on secure virtual circuits, authentication, encryption, and data integrity within secure links. Also expected to be voted on at the forum's annual meeting in Berlin are LAN emulation (LANE) over ATM and Multiprotocol over ATM (MPOA) MIBs (Management Information Bases).

If approved by straw ballot, the draft specifications will go on to the forum's executive committee for final approval. Specifications approved in Berlin are expected to be published in July, according to the forum's forecasts. But although vendors believe the LANE and MPOA specifications should pass easily, there is some doubt as to whether the draft security standard will be affirmed.

"Standards are important to us, [but] quite a bit [of ATM security] is left to vendor implementations" said Patrick leMaistre, senior communications engineer at Health Sciences Centre in Winnipeg, Manitoba, one of the area's largest health-care facilities.

"The LANE [MIB] and MPOA [MIB] specifications are add-ons to previous work," said Greg Ratta, technical committee chairman of the forum and manager of ATM standards at Lucent Technologies Inc.'s Bell Laboratories in Holmdel, N.J. "The management enhancements to the specification fix some 'gotchas' from the earlier spec," he said.

However, Ratta, along with spokespersons from several large networking companies, were not certain whether the security specification had the same groundswell of support; several vendors interviewed said their forum representatives were not even aware of the security proposal.

According to the draft security specification, "[the] document specifies mechanisms for authentication, confidentiality, data integrity, and access control for the user plane. It also specifies mechanisms for authentication and integrity for the control plane (UNI [user-to-user interface] and NNI [network-to-network interface] signaling).

"Excluded from the scope of this specification is management plane security ... Also within scope is the infrastructure needed to support these security services: negotiation of security services and parameters, key exchange, and certification infrastructure."

Carter Bullard, a principal consultant at Bay Networks Inc. in New York and editor of the UNI 4.0 Signalling Security Addendum, said that on LANs, companies use non-ATM-based security tools for authentication, encryption, and data integrity. Security technology changes for WANs.

The draft standard addresses four key security aspects: access control, authentication, cryptographic integrity, and encryption. Based on the needs of a particular connection, different aspects of the draft come into play, Bullard said.

One aspect of the draft is to provide security on a per-virtual-circuit basis where the services come into play after the circuit is created but before data transfers begin. Another set of security services are put into place when the connection is being established.

IS impact
Many IS and network managers are watching The ATM Forum's security and MIB votes with a keen eye.

Health Sciences Centre uses LANE over its ATM network, which is primarily made up of 3Com Corp. devices. Despite the lack of an ATM Forum specification for LANE client management, the medical facility has been able to get its 3Com ATM core switches to interoperate with ATM hardware from Cisco Systems Inc., said leMaistre.

Although leMaistre is concerned with the medical facility being able to exchange data with other ATM networks, he said his workaround has been to depend on his vendor, in this case 3Com, to provide proprietary software to address issues that The ATM Forum's work had not.

Although leMaistre tries to follow the activities of the forum and other standards bodies, much of his time is spent "considering the advanced features," many of them proprietary, of his existing ATM gear.

At Kaiser Permanente's computer center in Pasadena, Calif., Doug Crawford, manager of technical planning, said that as Kaiser migrates from using private lines and time-division multiplexers (TDMs) to using public services, the health maintenance organization needs a method to manage encryption and authentication, he said.

Kaiser, in the process of a national network upgrade, has standardized on ATM products and services from Cisco, Northern Telecom Ltd., and MCI Corp.

The health-management organization is using a "semi-proprietary mechanism" from Nortel to handle sorting and switching, Crawford said, but is waiting for The ATM Forum's approval of the LANE and MPOA MIBs because he prefers standards to proprietary approaches.

As software vendors add capabilities to the products, Crawford wants assurances that the applications will behave correctly in his ATM environment. Specifically, he is concerned that some applications with Quality of Service (QoS) enabled will tell the ATM switches that they are high priority, even if the IS department considers them a lower priority. Standards-based management tools that control those applications are required, he said, because proprietary tools might not be able to identify all of the prioritization settings.

Like Kaiser, Carnival Corp., a cruise line company in Miami, is also waiting for the LANE 2 MIB to be approved, but for a different reason. Whereas Kaiser is concerned with interoperability, Carnival's John Masseria, manager of systems support, is more concerned with unscheduled downtime.

Carnival is using 3Com's proprietary failover mechanism, but that doesn't kick in until the system has been down for 10 minutes. "That's just unacceptable," Masseria said, characterizing the length of time as "an eternity."

One of 3Com's limitations, he said, is its lack of proprietary offerings where no standards exist. "[3Com] is almost too committed to standards," Masseria said. 3Com would rather offer nothing at all than introduce a product that will change in the future, he said.

Standards-based switch
Users won't have long to wait for standards-compliant offerings. Hitachi Internetworking, the Santa Clara, Calif.-based unit of Hitachi Computer Products America Inc., is among the first to introduce a backbone switch that supports the draft MPOA and LANE client software MIBs. Richard Sweatt, marketing director at Hitachi, said buyers of pre-standard products will have their software upgraded to the standard for free once it's passed by the ATM Forum.

Sweatt said the switch, dubbed the Advanced Node (AN) 1000 Enterprise Switch family, is designed for applications beyond data networking. The company is working with other Hitachi divisions to add traditional PBX functions to the unit, which already supports store-and-forward video capabilities, he said.

The AN 1000-5, priced at $16,985 and available now, has 32 OC-3 ports. The AN 1000-3, priced at $9,985 and due to ship in June, has 16 OC-3 ports. The product family supports dual 2.5Gbps links in a fully redundant architecture.

Redundancy is one area not on the docket for next week's ATM Forum meeting that network managers would like to see addressed. Both Kaiser's Crawford and Health Science Centre's leMaistre say redundancy still ranks as one of the key shortcomings of ATM. "FDDI addressed [redundancy] in the specification," leMaistre said. "It's always very clear. With ATM, it's the vendor's [proprietary] implementation."

But next week's vote may not even answer the security question, said Bay's Bullard. Although the security specification covers a lot of ground, Bullard believes there is a good chance it will not pass the straw vote for that reason.

He anticipates that The ATM Forum will ask that the document be broken up in several specifications that could be discussed and analyzed more easily in smaller pieces. If that occurs, he said, the forum will be without a security standard for at least another six months.

 


Copyright 2001- 2002
All trademarks are the property of their respective companies.