|
|
xiii | |
|
|
xvii | |
Preface |
|
xix | |
Acknowledgements |
|
xxiii | |
PART I IP Technology Fundamentals |
|
|
|
3 | (24) |
|
The Golden Age of the Telecommunication Industry |
|
|
3 | (2) |
|
Internet -- The New Kid on the Block |
|
|
5 | (2) |
|
Metamorphosis of the Telecommunications Industry |
|
|
7 | (1) |
|
Rising Intelligence in the Network |
|
|
8 | (3) |
|
|
11 | (1) |
|
End-point Devices and the Changing the Role of Networks |
|
|
12 | (1) |
|
Growing Dependency on Middleware |
|
|
13 | (1) |
|
Need for Protocol Mediation and Translation in the Network |
|
|
14 | (2) |
|
Emergence of IP as the Unifying Mechanism of Computing and Communication |
|
|
16 | (2) |
|
From Protocols to Interfaces |
|
|
18 | (1) |
|
Challenges for the 21st Century Networks |
|
|
19 | (5) |
|
Empowering Anyone to become a Service Provider? |
|
|
20 | (2) |
|
Enabling Faster Time to Market at Lower Cost |
|
|
22 | (1) |
|
Reducing Complexity and Providing for Ease-of-use |
|
|
22 | (1) |
|
Design for Seamless Interoperability and Mobility |
|
|
23 | (1) |
|
Working towards Reliable IP Networks |
|
|
24 | (1) |
|
Consolidated Intelligence in Data Networks |
|
|
24 | (1) |
|
|
24 | (3) |
|
|
27 | (48) |
|
Public Switched Telephone Network (PSTN) |
|
|
27 | (7) |
|
|
30 | (1) |
|
Private Branch Exchange, Key Systems, and Centrex |
|
|
31 | (1) |
|
Services Spanning both the PSTN and the Internet |
|
|
32 | (2) |
|
|
34 | (5) |
|
Network Access and the Local Loop |
|
|
39 | (2) |
|
|
41 | (6) |
|
|
47 | (2) |
|
|
47 | (1) |
|
|
48 | (1) |
|
HotJava and the ``tumbling'' Duke |
|
|
48 | (1) |
|
|
49 | (1) |
|
|
49 | (4) |
|
IPSec: Internet Protocol Security |
|
|
53 | (3) |
|
Common Object Request Broker Architecture |
|
|
56 | (1) |
|
|
57 | (5) |
|
|
62 | (4) |
|
IP Telephony and Voice over IP |
|
|
66 | (3) |
|
|
69 | (1) |
|
|
70 | (2) |
|
|
72 | (3) |
PART II IP Service Platform Fundamentals |
|
|
Network-enabled and Online Services |
|
|
75 | (28) |
|
The Market for Online Services |
|
|
78 | (2) |
|
Issues with the Development and Delivery of Network-Enabled and Online Services |
|
|
80 | (4) |
|
Implications of these Issues |
|
|
81 | (1) |
|
Network-Enabled and Online Services Architecture |
|
|
81 | (2) |
|
The Opportunity for Network Carriers |
|
|
83 | (1) |
|
A Solution: IP Service Platform |
|
|
84 | (6) |
|
Benefits of Networking Middleware |
|
|
89 | (1) |
|
Service Provisioning Scenario |
|
|
90 | (11) |
|
How a Service is Deployed |
|
|
91 | (6) |
|
|
97 | (1) |
|
Network Integration Services |
|
|
98 | (1) |
|
How Authentication Tokens Can Protect Network Web Content |
|
|
98 | (2) |
|
Multiple Networks and Accounts |
|
|
100 | (1) |
|
|
101 | (2) |
|
Platform Requirements and Principles |
|
|
103 | (24) |
|
|
103 | (3) |
|
|
106 | (7) |
|
Adequate Security for Acceptable Cost |
|
|
106 | (2) |
|
Technical Security Differs from Organizational Trust |
|
|
108 | (1) |
|
|
108 | (2) |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
111 | (1) |
|
|
112 | (1) |
|
|
113 | (1) |
|
|
113 | (5) |
|
Current or Known Solutions |
|
|
115 | (1) |
|
Client-Server Architecture |
|
|
115 | (1) |
|
Client-Server Architecture Extended with Proxy Machines |
|
|
116 | (1) |
|
Architecture Based on Communicating Proxy Machines |
|
|
116 | (1) |
|
Multiple Servers and POPs |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
119 | (6) |
|
|
120 | (1) |
|
|
121 | (1) |
|
|
121 | (1) |
|
|
122 | (1) |
|
|
123 | (1) |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
125 | (2) |
|
Cloud Architecture and Interconnections |
|
|
127 | (24) |
|
|
128 | (6) |
|
Applications, Kernels and Switches |
|
|
129 | (1) |
|
Points of Presence (POPs) and System Operation Centers (SOCs) |
|
|
129 | (2) |
|
|
131 | (2) |
|
POP Based Authentication and Aggregation |
|
|
133 | (1) |
|
Small Cloud: Development and Providers |
|
|
134 | (2) |
|
Large Service Node Cloud, the SNode |
|
|
136 | (1) |
|
Distributed Network Cloud (GuNet) |
|
|
137 | (2) |
|
Gates as Distributed Network Elements (DNE) |
|
|
139 | (5) |
|
Routing Protocols and the Inherent Difficulty of Resource Allocation |
|
|
139 | (2) |
|
Distributed Network Element Integrates Gate with Network Elements |
|
|
141 | (1) |
|
DNE Specialization of Gate Functionalities |
|
|
141 | (1) |
|
|
142 | (2) |
|
|
144 | (1) |
|
Scaling with Multiple Clouds |
|
|
144 | (1) |
|
|
145 | (6) |
PART III Building the IP Service Platform |
|
|
Interoperable and Scalable Security |
|
|
151 | (62) |
|
|
152 | (3) |
|
Cryptographic Fundamentals of Secure Systems |
|
|
155 | (7) |
|
|
156 | (2) |
|
Asymmetric-key Encryption |
|
|
158 | (1) |
|
Digital Signatures - Cryptographic Seals |
|
|
159 | (3) |
|
Peer Credential and Key Management |
|
|
162 | (18) |
|
Authentication and Session Layers |
|
|
165 | (2) |
|
|
167 | (1) |
|
|
168 | (1) |
|
|
169 | (1) |
|
|
169 | (1) |
|
|
170 | (1) |
|
Peer-Based Credential Usage |
|
|
170 | (2) |
|
|
172 | (1) |
|
|
172 | (2) |
|
|
174 | (1) |
|
|
175 | (1) |
|
|
175 | (2) |
|
|
177 | (2) |
|
Security Applications and Benefits |
|
|
179 | (1) |
|
Trust Boundaries: Firewalls and Protocols |
|
|
180 | (7) |
|
|
180 | (3) |
|
Discussion of Rules-Based FIrewall |
|
|
183 | (4) |
|
Public Key Infrastructure - PKI |
|
|
187 | (11) |
|
PKI and the X.509 v3 Certificate Authority |
|
|
188 | (2) |
|
Certificates Characteristics and Syntax |
|
|
190 | (1) |
|
|
191 | (1) |
|
Middleware Networks and the Public Key Infrastructure |
|
|
192 | (1) |
|
Five Principles of an Open PKI |
|
|
193 | (1) |
|
Advantages of PKI Principles |
|
|
194 | (2) |
|
Additional Value-Added Services |
|
|
196 | (1) |
|
Conformance and Compliance with External CA |
|
|
197 | (1) |
|
|
198 | (3) |
|
Authentication, Secure Single-Sign-On and Service-Access |
|
|
201 | (10) |
|
Web Browser Security - Peerless Web Login and Service Access |
|
|
202 | (1) |
|
Saved State in RFC-2109 ``Cookies'' |
|
|
203 | (1) |
|
Encrypted Cookies from Authentication to Termination |
|
|
204 | (2) |
|
Microsoft NTLM and Browser Authentication |
|
|
206 | (1) |
|
Microsoft Security Architecture |
|
|
206 | (1) |
|
Single-Sign-On to Middleware Services through NTLM |
|
|
207 | (1) |
|
Single-Sign-On to Microsoft Services through Middleware |
|
|
208 | (2) |
|
LDAP Credentials with Microsoft Commercial Internet System |
|
|
210 | (1) |
|
|
211 | (2) |
|
APIs and Managed Infrastructure |
|
|
213 | (26) |
|
|
214 | (6) |
|
Middleware as Integrator of Standards |
|
|
215 | (1) |
|
Middleware as Extender of Standards |
|
|
216 | (1) |
|
Characteristics of Network Middleware APIs |
|
|
217 | (1) |
|
Object Oriented and Extensible |
|
|
218 | (1) |
|
|
218 | (1) |
|
|
219 | (1) |
|
Comparison with Remote Procedure Call (RPC) |
|
|
220 | (1) |
|
|
220 | (6) |
|
Substrate: Middleware-Defined Networks |
|
|
220 | (4) |
|
Middleware as Service Manager: The Service Model |
|
|
224 | (1) |
|
Middleware as Manager of Global Shared State |
|
|
225 | (1) |
|
Organization of the Middleware APIs |
|
|
226 | (10) |
|
|
228 | (4) |
|
SD - Service Development and Peer |
|
|
232 | (1) |
|
|
233 | (2) |
|
|
235 | (1) |
|
Operations Development - OD |
|
|
235 | (1) |
|
|
236 | (3) |
|
|
239 | (44) |
|
Overview of SNode --- Edge Gateway Functionality |
|
|
242 | (4) |
|
|
244 | (2) |
|
Active Registries: Connections, Users and Services |
|
|
246 | (12) |
|
Authenticated User Registry (AUR) |
|
|
248 | (1) |
|
Authenticated Service Registry (ASR) |
|
|
249 | (1) |
|
Authenticated Connections Table (ACT, AuthConnTab) |
|
|
250 | (1) |
|
Programming the Registries -- AUR, ASR and ACT |
|
|
251 | (2) |
|
Validation of Identity -- Peer and HTTP CallerID |
|
|
253 | (1) |
|
Specification of Connection Control -- Packet Filter API |
|
|
254 | (2) |
|
Validation of Access Control -- Access Check API |
|
|
256 | (1) |
|
Usage Recording and Retrieval APIs |
|
|
256 | (1) |
|
Summary of the Gate Architecture and Capabilities |
|
|
257 | (1) |
|
Domains: Accounts, Users and Services |
|
|
258 | (13) |
|
|
260 | (1) |
|
|
261 | (1) |
|
Domain Objects: Accounts, Users, and Services |
|
|
262 | (1) |
|
|
262 | (3) |
|
|
265 | (1) |
|
Service Access Control List |
|
|
265 | (1) |
|
|
266 | (1) |
|
|
266 | (1) |
|
Retrieving Attribute Values |
|
|
267 | (2) |
|
Retrieving Multiple Attribute Values in One Network Call |
|
|
269 | (1) |
|
|
270 | (1) |
|
C++ Example Running as Proxy Code |
|
|
271 | (1) |
|
|
271 | (11) |
|
SD APIs for Service Development and Development and Peer |
|
|
272 | (4) |
|
Service Development (SD) Application Models |
|
|
276 | (1) |
|
|
277 | (1) |
|
Monolithic Peer Application Model |
|
|
278 | (1) |
|
Connection Objects Independent of Domains and Locations |
|
|
279 | (2) |
|
External Peer Application Model |
|
|
281 | (1) |
|
|
282 | (1) |
|
Mechanisms of Middleware Components |
|
|
283 | (48) |
|
Rules-Based Packet Filter Firewall |
|
|
283 | (7) |
|
Rules Management: Unambiguous Caching of Dynamic Entries |
|
|
287 | (2) |
|
How to Build a Packet Filter |
|
|
289 | (1) |
|
Security Framework: Authentication Proxy and Agents |
|
|
290 | (14) |
|
Authentication Agent -- Control Daemon and Peers |
|
|
294 | (1) |
|
Authentication Agents -- Data Proxy and Secured Web ``Logins'' |
|
|
294 | (2) |
|
Authentication -- RADIUS Dial Support and Session Control |
|
|
296 | (1) |
|
Firewall and Access Control -- Access Daemon |
|
|
297 | (3) |
|
Middleware-Based PKI and PKI Management |
|
|
300 | (1) |
|
PKI as Basis for Wide Scale Single-Sign-On |
|
|
301 | (1) |
|
Credential Generation -- Accreditation of Authorities |
|
|
302 | (1) |
|
Credential Enrollment -- Importation of Certificates |
|
|
303 | (1) |
|
Credential Revocation -- Invalidation of Thumbprints |
|
|
303 | (1) |
|
Examples of PKI Management and Revocation Services |
|
|
304 | (1) |
|
|
304 | (5) |
|
Proxy Framework Mechanisms |
|
|
305 | (1) |
|
|
306 | (2) |
|
Summary of Proxy and Component Interactions |
|
|
308 | (1) |
|
Proxy Design, Deployment and Methodology |
|
|
309 | (14) |
|
Deployment of Proxy-Enabled Services |
|
|
309 | (1) |
|
Proxy-Enabled Service Definition |
|
|
310 | (1) |
|
Proxy-Enabled Service Activation |
|
|
311 | (1) |
|
Proxy-Enabled Traffic Flow for Gate-Deployed Mediation |
|
|
312 | (1) |
|
Proxy Design and Development Methodology |
|
|
313 | (1) |
|
Proxy Affinity and Server Affinity |
|
|
313 | (2) |
|
Examples of Proxy Affinity and Server Affinity |
|
|
315 | (1) |
|
Enhancement Examples -- DNS, HTTP and CIFS |
|
|
315 | (1) |
|
DNS: End-point Enhancement for Names and Services |
|
|
316 | (1) |
|
HTTP: Web Development Framework |
|
|
317 | (1) |
|
CIFS: Data Path Enhancement for File and Print Services |
|
|
318 | (5) |
|
Programmable Interfaces for Networks (PIN) |
|
|
323 | (7) |
|
Edge Gateway Architecture and Distributed Network Element (DNE) |
|
|
324 | (1) |
|
Broadband Network Reference Implementation of PIN |
|
|
324 | (3) |
|
Distributed Network Element -- DNE |
|
|
327 | (3) |
|
|
330 | (1) |
|
Systems Management and Monitoring |
|
|
331 | (14) |
|
Third-party Network Management System |
|
|
334 | (2) |
|
|
336 | (2) |
|
Event System, An Overview |
|
|
338 | (5) |
|
|
339 | (1) |
|
|
339 | (1) |
|
|
340 | (1) |
|
|
341 | (2) |
|
|
343 | (2) |
|
|
345 | (6) |
|
|
347 | (4) |
|
Conclusion: Future Directions |
|
|
351 | (10) |
|
Application Service Providers |
|
|
353 | (3) |
|
ASPs and IP Service Platforms |
|
|
356 | (2) |
|
|
358 | (3) |
Glossary |
|
361 | (4) |
References |
|
365 | (6) |
Index |
|
371 | |