Wilamowski B.M., Irwin J.D. The Industrial Electronics Handbook. Second Edition: Industrial Communication Systems

Подождите немного. Документ загружается.

Quality of Service 19-3

19.2 relationship with Information Security topics

As.remarked.before,.some.of.the.topics.related.with.QoS.are.the.information.security.facts.that.any.

netw

ork

.prof

essional

.must.know

.at.leas

.at.an.intr

oductory

.leve

.rela

ted

.with.the.need.of.cont

inuous

avai

lability

.and.rel

iability

.of.the.ind

ustrial

.net

work

.and.dat

.spe

cial

.sec

urity

.pro

blems

.in.ind

ustrial

.net

works,

.it.is.nec

essary

.to.emp

hasize

.the.fol

lowing:

•

. Phys

ical security problems:

. e.scop

.of.thes

.prob

lems

.is.the.rang

.of.devi

ces

.foun

.in.a.net-

ork:

.PCs.or.clie

.works

tations,

.serve

rs,

.rout

ers,

.switc

hes,

.or.spec

ial

.dedi

cated

.equi

pment.

Espe

cially

.for.the.most.sens

ible

.devi

ces,

.if.they.are.not.corre

ctly

.place

.they.face

.a.poss

ible

dest

ruction

.or.an.easy.unau

thorized

.acce

.to.the.cons

ole

.of.the.devi

ce,

.with.the.cons

equent

risk.for.the.cont

rol

.of.the.devi

.or.for.the.data.bein

.ther

.and,.as.a.cons

equence,

.for.the.valu

of.the.netw

ork.

•

. Sow

are security problems:

.It.is.nece

ssary

.to.incl

ude

.here.the.oper

ating

.syst

ems

.of.devi

ces,

.any.IP.

proto

cols

.impl

ementation,

.and.any.indu

strial

.appl

ication

.inst

alled

.in.the.devi

ces.

. e.most.com-

on.problems.are.the.security.bugs.due.to.bad.coding.(very.common),.the.insecure.conguration.

of.the.auth

entication

.and.auth

orization

.les.in.the.oper

ating

.syst

em,

.the.inse

cure

.con

guration

of.the.perm

issions

.for.the.le.syst

ems,

.or.a.bad.poli

.for.the.secu

rity

.copi

.of.the.data

.Also

itmu

.be.take

.into.acco

unt

.the.prob

lems

.due.to.inco

rrect

.impl

ementation

.of.proto

col

.stac

or.the.use.of.dang

erous

.proto

cols

.or.appl

ications,

.as.the.case.for.Teln

et,

.p,.tp,.RIP,.SMTP

andsoo

•

. A.signi

cant

.emph

asis

.must.be.put.on.the.need.of.havi

.a.good.anti

virus

.syst

.and.spec

ial

.con-

rol

.for.the.atta

chments

.in.any.mail.ente

red

.in.the.netw

ork,

.espe

cially

.if.our.indu

strial

.netw

ork

shar

.the.med

.wit

.the.sta



.net

work.

•

. It.is.also.impo

rtant

.to.take.time.to.anal

yze

.the.secu

rity

.in.the.fund

amental

.netw

ork

.devi

ces,

.the.

swit

ches

.and.the.rout

ers.

. ey.are.no.more.than.hard

ware

.and.sow

are;

.but.the.cons

equences

.of.

secu

rity

.brea

ches

.in.them.can.be.extr

emely

.dang

erous.

.For.exam

ple,

.if.one.of.the.swit

ches

.in.our.

netw

ork

.sue

.a.deni

.of.serv

ice

.atta

ck,

.ever

.devi

.runn

ing

.our.appl

ications

.is.disc

onnected

and.the.nal.resu

.is.that.we.have.no.netw

ork.

.Some

times

.also.we.can.sue

.a.captu

.atta

.in.

one.of.our.rout

ers

.and,.from.the.rout

er,

.using.a.priv

ilege

.esca

lation

.tech

nique,

.our.serv

ers

.can.be.

hack

.and.obl

iged

.not.to.do.its.usu

.job.

rom

.the.tech

nical

.poin

.of.view.[5],.we.have.many.tools.to.face.all.thes

.secu

rity

.prob

lems,

.but,.in.

a.consi

stent

.way.with.the.idea.of.qual

ity

.expr

essed

.in.the.prev

ious

.sect

ion,

.we.need.a.secu

rity

.poli

.to.

orga

nize

.all.the.imp

lementations

.of.sec

urity

.def

enses.

.info

rmation

.secu

rity

.poli

.can.be.den

.as.“a.form

.stat

ement

.of.the.rule

.by.whic

.peop

le,

who.are.giv

.acc

ess

.to.an.org

anization’s

.tec

hnology

.and.inf

ormation

.ass

ets,

.mus

.abi

de”

.[6]

.main.goal.is.to.info

.all.the.peop

.in.the.orga

nization

.abou

.the.obli

gatory

.requ

irements

.to.

obse

rve,

.to.pro

tect

.the.tec

hnological

.val

ues

.and.res

ources

.and.all.the.org

anization’s

.inf

ormation.

.poli

.must.make.expl

icit

.the.mech

anisms

.for.us.to.obey.each.norm.and.the.meth

odology

.to.fol-

.for.each.of.the.part

icular

.case

.If.it.is.comp

lete

.enou

gh,

.it.can.give.the.hint

.to.sele

.the.tech

nolo-

gies,

.inc

luding

.so

ware

.and.har

dware

.to.imp

lement

.the.pol

icy.

.bui

.a.goo

.net

work

.sec

urity

.pol

icy

.for.a.con

crete

.org

anization,

.a.numb

.of.key.que

stions

.mus

be.ans

wered:

•

. What.exac

tly

.must.be.prot

ected?

.Firs

.a.comp

lete

.inve

ntory

.must.be.buil

.taki

.into.acco

unt

die

rent

.secu

rity

.stan

dards

.like.ISO/

IEC

.2700

.[7].or.ISO/

IEC

.1540

.[8].. en,.a.sele

ction

.(wit

assig

ned

.pri

orities)

.of.the.act

ives

.to.pro

tect

.mus

.be.bui

lt.

•

. Who.coul

.atta

.our.netw

ork?

.It.is.extr

emely

.impor

tant

.to.anal

yze

.ever

.inte

rnal

.and.exte

rnal

peop

.that.work.with.us.and.deci

.in.whic

.trus

.Also

.it.is.a.good.idea.to.thin

.abou

.the.

possible.motivations.of.virtual.attackers.

19-4 Industrial Communication Systems

•. How.are.the.systems.and.tools.selected.to.implement.the.security.policy.going.to.be.used?. ere.

will.be.crypto

graphic

.defe

nses

.and.no.crypto

graphic

.ones.and.it.will.be.impo

rtant

.to.know.the.

die

rent

.kin

.of.att

acks

.and.def

enses.

•

. How.much.mone

.coul

.the.orga

nization

.aor

.to.impl

ement

.the.poli

cy?

. is.data.item.give

agrea

.inp

.to.dec

ide

.whi

.way.can.be.use

.to.beg

.to.imp

lement

.the.pol

icy.

Once

.the.secu

rity

.poli

.(or.at.leas

.the.rst.oper

ating

.versi

on)

.is.buil

.it.is.nece

ssary

.to.star

.the.

secu

rity

.proc

ess

.with

.the.info

rmation

.secu

rity

.mana

gement

.syst

.[7]..It.can.be.stru

ctured

.in.thre

cont

inuous

.pha

ses:

. 1..Impl

ementation phase:

.Ever

.orga

nizational

.meas

ure

.of.the.poli

.must.be.acti

vated,

.incl

uding

all.the.con

gurations

.for.ser

vers,

.rou

ters,

.swi

tches,

.re

walls,

.etc

. 2.. Moni

toring phase:

.Audi

.and.cont

inuous

.moni

toring

.of.syst

ems

.and.netw

orks

.must.be.done.to.

assu

.that.the.secu

rity

.rest

rictions

.are.work

ing

.and.to.inve

stigate

.possi

ble

.new.secu

rity

.prob

lems,

.not.pre

viously

.det

ected

.or.tho

ught

.of.

. 3..Secu

rity adulting phase:

.Vuln

erability

.audi

.and.secu

rity

.test

.must.be.done

.espe

cially

.to.sensi

ble

devi

ces

.and.ser

vers,

.in.ord

.to.get.new.pos

sible

.tec

hnical

.or.org

anizational

.vul

nerabilities.

Adding

.the.resu

lts

.of.phase

.2.and.3,.we.get.new.direc

tions

.for.upda

ting

.the.securi

.poli

.buil

ding,

.say,.

the.oper

ating

.vers

ion

.2,.that.we.must.impl

ement

.putt

ing

.agai

.in.the.rst.phase.of.the.proc

ess,

.and.so.on.

.nis

.this.sect

ion,

.it.is.impo

rtant

.to.poin

.out.a.numbe

.of.comm

ittees

.and.stan

dards

.that.can.help.

to.bui

.a.con

crete

.sec

urity

.pol

icy

.for.a.con

crete

.ind

ustrial

.net

work:

•

. IEEE.140

.[9]

.a.sec

urity

.sta

ndard

.for.sub

stations,

.esp

ecially

.dev

oted

.to.phy

sical

.sec

urity.

•

. Proc

ess

.Cont

rol

.Secu

rity

.Requ

irements

.Foru

.(PCS

RF)

.[10]

.spon

sorized

.by.NIST

.Its.goal.is.to.

buil

.a.qual

ity

.and.secu

rity

.stan

dards

.set.for.buil

ding

.new.indu

strial

.proc

ess

.cont

rol

.syst

ems.

.It.

has.deve

loped

.norm

.for.DCS.and.SCAD

.syst

ems,

.like.the.SCP-

ICS

.(Ind

ustrial

.Cont

rol

.Syst

Secu

rity

.Cap

abilities

.Pro

le)

.or.the.SPP

-ICS

.(In

dustrial

.Con

trol

.Sys

tem

.Sec

urity

.Pro

le).

•

. ISA S

P99:

. e.SP99.[11].comm

ittee

.of.Inst

rumentation

.Syst

ems

.and.Autom

ation

.(ISA

)

.deve

lops

“gui

de-alike”

.doc

uments

.for.int

roducing

.inf

ormation

.sec

urity

.in.auto

matized

.con

trol

.sys

tems.

•

. IEC T

C65:

.Tech

nical

.subc

ommittee

.65C.of.the.IEC.is.work

ing

.since.2004.in.secu

rity

.stan

dards

.for.

eld.bus

.and.oth

.ind

ustrial

.com

munication

.net

works.

19.3 Quality of Service for IP Networks

Traditionally,.the.term.“quality.of.service”.refers.to.a.series.of.techniques.[12].and.methodologies.[2,3].

whos

.targ

ets

.are.to.assig

.die

rent

.prio

rities

.to.die

rent

.kind

.of.tra

.in.the.IP.netw

ork.

.Also.refe

to.impl

ement

.mana

gement

.poli

cies

.to.hand

.the.late

ncy,

.dela

.and.band

width.

. ese.tech

niques

.try.

to.give.a.dist

inctive

.and.pref

erential

.trea

tment

.to.the.tra

.corr

esponding

.to.the.most.crit

ical

.appl

ica-

tions

.in.the.netw

ork.

. is.trea

tment

.must.be.homo

geneous,

.the.same.trea

tment

.in.all.the.area

.in.the.

netw

ork.

. e.poli

.must.allo

.the.chan

ges,

.must.be.dyna

mic

.beca

use

.of.the.possi

ble

.chan

ging

.situa

tions

.of.the.serv

ices

.in.the.netw

ork.

.Nowa

days,

.they.are.an.esse

ntial

.comp

onent

.to.assu

.the.corr

ect

perf

ormance

.of.the.app

lications

.in.the.net

work.

Any

.net

work

.may.exp

erience

.any.of.the

.net

work

.ava

ilability

.pro

blems:

•

. Delay:.Also.named.latency,.is.the.amount.of.time.that.it.takes.a.packet.to.reach.the.receiving.

endp

oint

.aer.bein

.tran

smitted

.from.the.send

ing

.endp

oint.

. is.peri

.can.be. brok

.into.

two.area

.xed.netw

ork

.dela

.and.vari

able

.netw

ork

.dela

. e.xed.part.incl

udes

.enco

ding

.and.

deco

ding

.time

.(for.voic

.and.vide

.for.exam

ple)

.as.well.as.the.amou

.of.time.requ

ired

.for.the.

elec

trical

.and.optic

.puls

.to.trav

erse

.the.medi

.to.thei

.dest

ination.

. e.vari

able

.part.gene

rally

refe

.to.netw

ork

.cond

itions,

.such.as.cong

estion,

.that.is.goin

.to.aec

.the.over

all

.time.requ

ired

for.tran

sit.

.For.data.netw

orks

.it.is.usua

.to.talk.abou

.pack

etization

.dela

.the.time.that.it.take

.to.

Quality of Service 19-5

segment.data.(if.needed),.encode.signals.(if.necessary),.process.data,.and.turn.data.into.packets;.

ser

ialization

.del

ay,

.the.tim

.tha

.tak

.to.pla

.the.bit

.of.a.pac

ket,

.enc

apsulated

.in.a.fra

me,

.onto.

the.phy

sical

.med

ia;

.the.pro

pagation

.del

.or.tim

.tha

.it.tak

.to.tra

nsmit

.the.bit

.of.a.fra

acr

oss

.the.phy

sical

.wir

.the.pro

cessing

.del

ay,

.the.tim

.tha

.tak

.a.net

work

.dev

ice

.to.tak

.the.

fra

.fro

.the.inp

.int

erface,

.pla

.it.into.a.rec

eive

.que

ue,

.and.pla

.it.into.the.out

put

.que

.of.

the.out

going

.int

erface;

.and.que

uing

.del

ay,

.the.amo

unt

.of.tim

.tha

.a.pac

ket

.resi

des

.in.the.out

put

que

.of.an.in

terface.

•

. Del

ay variation:

.Als

.nam

.“ji

tter”

.is.the.di

erence

.in.the.end

-to-end

.del

.bet

ween

.pac

kets.

.If,.

for.exa

mple,

.one.pac

ket

.req

uires

.100.ms.to.tra

verse

.the.net

work

.fro

.the.sou

rce

.end

point

.to.the.

des

tination

.end

point,

.and.the.fol

lowing

.pac

ket

.req

uires

.130.ms.to.mak

.the.sam

.pat

.the.del

var

iation

.bet

ween

.pac

kets

.is.cal

culated

.as.30.ms..Man

.dev

ices

.in.a.net

work

.hav

.a.jit

ter

.bu

.for.

smo

othing

.ou

.ch

anges

.in.ar

rival

.ti

mes

.of.da

.pa

ckets

.co

ntaining,

.fo

.ex

ample,

.vo

ice

.or.vi

deo.

•

. Pac

ket loss:

.It.is.a.mea

sure

.of.pac

kets

.tra

nsmitted

.and.rec

eived

.com

pared

.to.the.tota

.numb

.tha

wer

.tra

nsmitted

.and.exp

ressed

.as.the.per

centage

.of.pac

kets

.tha

.wer

.dro

pped.

.Tai

.dro

.occ

whe

.the.out

put

.que

.is.ful

.bei

.not.the.uni

que

.dro

.but.the.mos

.fre

quent

.one

.and.the.

ori

gin

.of.th

.dr

ops

.is.th

.co

ngestion

.in.th

.li

nk.

.is.imp

ortant

.to.see.tha

.man

.app

lications

.can.del

iver

.unp

redictable

.bur

sts

.of.tra

c.

.It.is.pra

ctically

imp

ossible,

.for.exa

mple,

.to.pre

dict

.the.usa

.pat

terns

.for.Web.or.le.tra

nsfer,

.but.net

work

.pro

fessionals

nee

.to.be.ab

.to.su

pport

.cr

itical

.ap

plications

.du

ring

.pe

riods.

QoS

.te

chnology

.pe

rmits

.to.do.th

.fo

llowing:

•

. Pre

dict

.re

sponse

.ti

mes

.fo

.en

d-to-end

.ne

twork

.se

rvices

•

. Man

age

.lo

.in.ti

mes

.of.in

evitable

.bu

rsty

.co

ngestion

•

. Man

age

.ji

tter

.or.de

lay

.se

nsitive

.ap

plications

•

. Set.tr

ac

.pr

iorities

.ac

ross

.th

.ne

twork

•

. Sup

port

.de

dicated

.ba

ndwidth

•

. Avo

.or.ma

nage

.ne

twork

.co

ngestion

.ach

ieve

.the

.res

ults,

.it.is.nec

essary

.to.do.a.con

stant

.mon

itoring,

.rea

l-time

.mon

itoring,

.a.car

ful

.trac.engineering.and,.once.we.get.these.features,.it.is.possible.to.create.a.good.planning.for.every.

app

lication.

Each

.of.th

.wi

.re

quire

.a.de

ned

.se

rvice

.le

vel.

. e.ob

jectives

.ca

.be.re

sumed:

•

. All.net

work

.tra

c

.mus

.rea

.its.ser

vice

.lev

els.

.For.exa

mple,

.kee

ping

.the.lat

ency

.bel

.a.cer

tain

val

.fo

.th

.vo

ice

.ov

.IP.tr

ac

.to.ge

.a.go

.qu

ality.

•

. Dur

ing

.the.per

iods

.of.net

work

.con

gestion,

.the.mos

.imp

ortant

.tra

c

.mus

.alw

ays

.enjo

.the.

res

ources

.it.ne

eds.

•

. As.an.add

.ben

et,

.the

.tec

hniques

.all

.to.opti

mize

.the.use.of.net

work

.res

ources,

.del

aying

.the.

nee

.to.sp

end

.mo

ney

.to.ad

.re

sources.

 ere

.ar

.a.nu

mber

.of.pr

ocesses

.[2

,12]

.in

volved

.in.Qo

•

. Cla

ssifying the trac:

.A.des

criptor

.val

.mus

.be.use

.to.cat

egorize

.a.pac

ket

.or.fra

.wit

hin

.a.

spe

cied

.gro

up.

. is.wil

.mak

.the.pac

ket

.acc

essible

.for.QoS.han

dling

.in.the.net

work

.or.wit

hin

.a.

net

work

.dev

ice.

. e.cla

ssication

.pro

cess

.wil

.all

.seg

menting

.the.tra

c

.into.mul

tiple

.pri

ority

lev

els

.or.cla

sses

.of.ser

vice.

.Ano

ther

.pos

sible

.app

roach

.is.“Qo

.sign

aling”

.in.whi

.the.cla

ssica-

tion

.is.do

.ba

sed

.on.ap

plication-ow

.ra

ther

.th

.a.pa

cket

.ba

sis.

•

. Tra

c shaping:

.It.is.use

.to.cre

ate

.a.tra

c

.ow.for.lim

iting

.the.ban

dwidth

.pot

ential

.of.the.ow

.It.

det

ermines

.if.a.pac

ket

.is.in.or.out.of.pro

le

.by.com

paring

.the.tra

c

.rat

.to.the.con

gured

.pol

ice,

whi

.lim

its

.the.ban

dwidth

.con

sumed

.by.a.ow.of.tra

c.

. e.tra

c

.exc

eeding

.the.con

gured

rat

.is.bu

ered

.r

.in.an.at

tempt

.to.mi

nimize

.lo

ss.

•

. Mar

king

.is.th

.pr

ocess

.of.se

tting

.or.ch

anging

.a.pr

iority

.va

lue

.of.a.fr

ame

.or.pa

cket.

19-6 Industrial Communication Systems

•. Queuing.is.used.to.evaluate.the.priority.value.and.the.congured.police.and.to.determine.in.

whi

.of.th

.ou

tput

.qu

eues

.th

.pa

cket

.mu

.be.pu

•

. Sch

eduling

.is.the.pro

cess

.tha

.ser

vices

.the.tra

nsmit

.que

ues,

.bas

.on.the.sha

ring

.and.sha

ping

con

guration

.of.th

.tr

ansmit

.po

rt.

•

. Dro

pping

.is.use

.to.dro

.pac

kets,

.to.tak

.adv

antage

.of.Tra

nsmission

.Con

trol

.Pro

tocol

.(TC

.and.

win

dowing

.mec

hanisms

.tha

.dro

.sel

ectively

.som

.pac

kets

.in.an.att

empt

.to.avo

.dro

pping

.muc

mor

.pac

kets.

. is.doe

.not.wor

.wit

.app

lications

.usin

.Use

.Dat

agram

.Pro

tocol

.(UD

.as.the.

tra

nsport

.pr

otocol,

.on

.fo

.th

.TC

.on

es.

.the.oth

.side

.the.QoS.fea

tures

.mus

.be.con

gured

.thr

oughout

.the.net

work

.for.pro

viding

.end

-to-

end

.QoS.delivery..And.there.are.three.components.needed.to.get.this.consistency:

•

. QoS.com

ponents

.wit

hin

.a.sing

.net

work

.ele

ment,

.inc

luding

.que

uing,

.sch

eduling,

.and.tra

c

sha

ping.

•

. QoS.sig

naling

.te

chniques

.to.co

ordinate

.Qo

.fr

.en

.to.en

.be

tween

.ne

twork

.el

ements.

•

. QoS. pol

icing

.and.man

agement

.fun

ctions

.to.con

trol

.and.adm

inister

.end

-to-end

.tra

c

.acr

oss

anet

work.

 ere

.are.now

adays

.onl

.two. QoS. arc

hitectures

.for.IP.net

works:

.the. Int

egrated

.Ser

vices

.mod

el,

(In

tServ)

.[13

.and.the.Di

erentiated

.Ser

vices

.mod

el,

.(Di

Serv)

.[14

. ey.are.di

erent

.in.the.way.the

ena

ble

.app

lications

.to.sen

.dat

.and.in.how.the.net

work

.att

empts

.to.del

iver

.the.dat

.wit

hin

.the.spe

cied

lev

.of.se

rvice.

19.3.1 Integrated Services (IntServ) Model

Integrated.Services.(IntServ).model.is.dened.in.RFC.1633.[13]..It.provides.multiple.services.that.can.

acc

ommodate

.mul

tiple

.QoS.req

uirements.

.It. can.be.use

.thr

ough

.the.int

roduction

.of.Res

ource

reS

erVation

.Pro

tocol

.(RS

VP,

.RFC.220

.and.393

.[16

–18],

.ena

bled

.at.bot

.the.end.poi

nts

.and.the.net

works

.dev

ices

.in.bet

ween.

.Eac

.RSV

P-enabled

.app

lication

.req

uests

.a.spe

cic

.kin

.of.ser

vice

.fro

.the.

RSV

P-enabled

.net

work

.bef

ore

.sen

ding

.the.dat

.Exp

licit

.sign

aling

.via.RSV

.mus

.occ

.to.fac

ilitate

.the.

req

uest.

.Ae

rward,

.the.app

lication

.inf

orms

.the.net

work

.of.its.tra

c

.pro

le

.and.req

uests

.a.par

ticular

kin

.of.ser

vice

.tha

.can.con

tains

.its.ban

dwidth

.and.del

.nee

ds.

. e.ide

.is.tha

.the.app

lication

.is.onl

goi

.to.se

.da

.a

.it.ge

.a.co

nrmation

.fr

.th

.ne

twork.

.kin

.of.RSV

P-enabled

.net

work

.doe

.als

.adm

ission

.con

trol,

.bas

.on.inf

ormation

.fro

.the.

req

uesting

.hos

.app

lication

.and.ava

ilable

.net

work

.res

ources,

.adm

itting

.or.reje

cting

.the.app

lication

req

uest

.for.ban

dwidth.

. e.net

work

.com

mits

.to.mee

.the.QoS.req

uirements

.of.the.app

lication

.whi

.the.

spe

cic

.tr

ac

.o

.fo

.wh

ich

.th

.re

quest

.wa

.ma

.re

mains

.wi

thin

.th

.pr

ole

.sp

ecications.

.is.als

.pos

sible

.to.cent

ralize

.adm

ission

.con

trol

.by.usi

.the.Com

mon

.Open.Pol

icy

.Serv

ice

.(CO

PS,

RFC.274

.[19

]

.pro

tocol

.at.a.pol

icy

.dec

ision

.poi

nt.

.When.use

.wit

.RSV

.COP

.pro

vides

.sev

eral

.bene

ts:

•

. Cen

tralized

.ma

nagement

.of.se

rvices

•

. Cen

tralized

.ad

mission

.co

ntrol

.an

.au

thorization

.of.RS

.o

•

. Inc

reased

.sc

alability

.of.RS

VP-based

.Qo

.so

lutions

.two.mai

.dra

wbacks

.of.RSV

.and.Int

Serv

.are.the.nee

.of.con

tinuous

.sign

aling

.due.to.the.sta

te-

less

.architecture.and.the.lack.of.scalability.and,.although.there.is.an.IETF.working.group.devoted.to.its.

stu

dy,

.it.is.no

.th

.mo

.co

mmonly

.us

ed.

19.3.2 Differentiated Services (DiffServ) Model

 e. DiServ. model. [14,15]. is. a. multiple. service-level. model. that. can. satisfy. diering. QoS. needs..

How

ever,

.unl

ike

.in.the.Int

Serv

.mod

el,

.an.app

lication

.tha

.use

.Di

Serv

.doe

.not.sign

.exp

licitly

.the.

Quality of Service 19-7

network.devices.before.sending.data..DiServ.reassigns.bits.in.the.type.of.service.(ToS).(8.bits.in.ToS,.

Figure.19.1).eld.of.the.IP.header.of.any.IP.packet.[20].and.uses.dierentiated.services.code.points.

(DSCP).as.the.QoS.descriptor.value,.which.supports.64.possible.classications.

For

.a.dierentiated.service,.the.network.is.trying.to.deliver.a.concrete.kind.of.service.based.on.the.

QoS.descriptor.specied.in.each.IP.packet.header.on.a.per-hop.basis.rather.than.per-trac.ow.as.

IntServ.does.

Usually,

.this.service.model.is.especially.appropriate.for.aggregate.ows;.complex.trac.classication.

are.performed.at.network.edges.resulting.in.a.per-packet.QoS.handling.

.device,.typically.at.the.edge.of.the.network,.identies.packets.based.on.the.IP.precedence.(the.

three.rst.bits.in.the.ToS.eld.of.the.IP.header).or.on.the.DSCP.elds.in.the.ToS.byte.of.the.IP.header.

(Figure.19.2).that.are.going.to.be.used.in.a.per-hop.behavior.(PHB),.packet.by.packet.

.six.most.signicant.bits.of.the.ToS.byte.form.the.DiServ.eld.and.the.last.two.bits.are.used.as.

early.congestion.notication.(ECN).bits..IP.precedence.uses.three.bits,.while.DSCP,.really.an.extension.

of.IP.precedence,.uses.six.bits.to.select.the.PHB.for.the.packet.at.each.network.node.

 ere

.are.two.typical.ways.for.specifying.this.PHB:.the.assured.forwarding.(AF).PHB.[21].and.the.

expedited.forwarding.(EF).PHB.[22].

.AF.group.allows.oering.dierent.levels.of.forwarding.assurances.for.IP.packets.received.from.

a.DiServ.domain.. ere.are.four.AF.classes,.named.AF1x.through.AF4x..Within.each.class,.there.are.

three.drop.probabilities..Depending.on.the.policy.of.the.network,.packets.can.be.selected.for.a.PHB.

based.on.required.throughput,.delay,.jitter.or.loss,.or.simply.according.to.priority.of.access.to.network.

services.

Version

Hd Len

Type of service Total length

Fragment offset

Header checksum

Flags

Identification

Time to live Protocol

Source IP address

Destination IP address

Options

Data portion

Padding

bytes

Variable

length

32 bits

FIGURE 19.1 ToS.eld.in.the.IP.header.of.any.IP.packet.

DiffServ field

ToS byte in IP header

P2 P1 P0 T3 CUT0T1T2

ECNECNDS0DS1DS2DS3DS4DS5

precedence

FIGURE 19.2 DiServ.eld.into.the.ToS.byte.of.an.IP.packet.

19-8 Industrial Communication Systems

 e.AF.PHB.model.is.nearly.equivalent.to.the.controlled.load.service.of.the.IntServ.model..It.denes.

a.method.to.give.dierent.forwarding.assurances.to.dierent.trac.classes..For.example,.network.trac.

can.be.divided.into.three.classes:

•

. Gold,.50%.of.the.available.bandwidth

•

. Silver,.30%.of.the.available.bandwidth

•

. Bronze,.20%.of.the.available.bandwidth

Table

.19.1.shows.the.DSCP.coding.for.specifying.the.AF.class.with.the.probability:.bits.0,.1,.and.2.

dene.the.class;.bits.3.and.4.the.drop.probability;.and.bit.5.is.always.0.

.EF.model.can.be.used.to.build.a.low-loss,.low-latency,.low-jitter,.assured.bandwidth.end-to-end.

service.through.dierent.DiServ.domains.. is.kind.of.service.is.also.named.a.premium.service.

19.3.3 Classication and Marking

 e.marking.process.identies.which.frames.or.packets.are.processed.to.meet.a.specic.level.of.service.

of.QoS.policy.for.end-to-end.service.

Using

.classications,.the.network.trac.can.be.classied.into.multiple.priority.levels.or.classes.of.

service.. ere.are.dierent.methods.of.identifying.types.of.trac,.but.the.two.most.used.are.the.inclu-

sion

.of.access.lters.or.the.network-based.application.recognition.(NBAR).[12].method,.a.classication.

engine.that.can.recognize.a.wide.variety.of.applications,.including.Web-based.applications.and.client/

server

.applications.that.dynamically.assign.TCP.or.UDP.port.numbers..Aer.the.application.is.recog-

nized,

.the.network.can.invoke.specic.services.for.that.particular.application.

.device.where.classications.are.accepted.(or.rejected).is.named.the.“trust.boundary.”. e.trust.

port.congurations.establish.a.trust.boundary.that.subsequent.network.devices.or.elements.in.the.net-

work

.will.enforce.. ere.are.methods.for.marking.trac.with.its.classication.that.allow.setting.infor-

mation

.in.layer.2,.3,.or.4.headers..Usually,.the.network.administrator.sets.trust.boundaries.based.on

•

. Parameters on layer 2:.IEEE.802.1Q.Class.of.Service.(CoS).bits.or.MAC.address.in.Ethernet.net-

works

.or.input.interface

•

. Parameters on layer 3:.IP.precedence,.DSCP,.QoS.group.or.IP.address.or.input.interface

•

. Parameters on layer 4:.TCP.or.UDP.ports.or.input.interface

•

. Parameters on layer 7:.Application.signatures.or.input.interface

.is.a.best.practice.design.recommendation.to.identify.and.mark.trac.as.close.to.the.source.of.the.

trac.as.possible.

.the.classication.and.marking.is.done.at.level.3.in.the.IP.stack.(typically.at.a.router),.the.method.

used.is.the.one.cited.with.DSCP.codes;.but.at.level.2.(at.a.switch),.it.is.typical.to.use.CoS.bits.in.the.

TABLE 19.1 DSCP.Coding.for.Specifying.AF.Class.and.the.Probability

Class 1 Class 2 Class 3 Class 4

001010

AF11

DSCP 10

010010

AF21

DSCP 18

011010

AF31

DSCP 26

100010

AF41

DSCP 34

Low drop

001100

AF12

DSCP 12

010100

AF22

DSCP 20

011100

AF32

DSCP 28

100100

AF42

DSCP 36

Medium drop

001110

AF13

DSCP 14

010110

AF23

DSCP 42

011110

AF33

DSCP 30

100110

AF43

DSCP 38

High drop

Quality of Service 19-9

incoming.frame.. en.the.CoS.to.DSCP.map.is.used.to.generate.the.internal.DSCP.value..With.VLANs.

in.use,.the.IEEE.802.1Q.frame.header.carries.the.CoS.value.in.the.three.most.signicant.bits.of.the.tag.

control.information.(TCI).eld.. e.CoS.values.range.from.0,.for.low.priority,.to.7,.for.high.priority..

Ifthe.frame.does.not.contain.a.CoS.value,.assign.the.default.port.CoS.to.the.incoming.frame.

19.3.4 Queuing and Congestion Management

Network.devices.handle.a.possible.overow.of.arriving.trac.by.using.a.queuing.algorithm.to.sort.the.

trac,.and,.then,.determine.a.method.for.assigning.priorities.onto.an.output.interface..Each.queuing.algo-

rithm

.solves.a.specic.type.of.network.trac.condition.and.has.a.particular.eect.on.network.performance.

Figure

.19.3.shows. the. actions. that.a.QoS-enabled. network.device.must.take. before.transmitting.

aframe..It.takes.these.steps:

•

. Classication.of.packets.

•

. It.must.be.determined.if.it.can.put.the.packet.into.the.queue.or.it.has.to.drop.the.packet..By.

default,.queuing.mechanisms.will.drop.a.packet.only.if.the.corresponding.queue.is.full,.this.is.

named.“tail.drop.”

•

. If.the.packet.is.queued,.it.is.placed.into.the.queue.for.that.particular.class.

•

. e.packets.are.then.taken.from.the.individual.per-class.soware.queues.and.put.into.a.FIFO.

hardware.or.transmit.queue.

.queuing.methods.dier.in.that.some.of.them.classify.packets.automatically.while.others.need.

manual.conguration;.but.the.most.important.part.of.every.queuing.mechanism.is.the.scheduling.

policy.because.it.says.the.order.in.which.the.packets.will.leave.the.network.device.

.the.other.side,.the.queuing.mechanisms.directly.relate.to.the.DiServ.model.and.usually.in.this.

way:

•

. Expedited forwarding PHB Implementations:.Use.the.priority.queuing.(PQ).or.the.IP.real-time.

transport.protocol.(RTP).[23].prioritization

•

. Assured forwarding PHB implementations:.Use.the.class-based.weighted.fair.queuing.(CBWFQ),.

four.classes.with.weighted.random.early.detection.(WRED).within.each.class,.or.the.custom.

queuing

.PQ.scheme.(Figure.19.4).is.designed.to.give.strict.priority.to.important.trac.and.assures.that.

priority.trac.is.serviced.most.oen.and.strictly.prioritizes.according.to.network.protocol.(such.as.IP.

or.IPX),.incoming.interface,.packet.size,.source,.or.destination.address.

Class 1?

Class 2?

Class n?

Add/drop

Queue 1

Queue 2

Queue n

Scheduler

Forwarded packets

Hardware

Hardware queuing

system

Interface

FIGURE 19.3 Queuing.components.

19-10 Industrial Communication Systems

PQ.uses.to.be.statically.congured.and.implemented.through.the.use.of.the.expedite.queue..One.

major.drawback.is.that.low.queues.may.never.be.sampled.as.long.as.higher.priority.trac.is.being.pro-

cessed,

.and.this.results.in.queue.non-use.

Figure

.19.5.shows.the.custom.queuing.system,.which.reserves.a.percentage.of.the.available.bandwidth.

of.an.interface.for.each.selected.trac.type..If.a.particular.type.of.trac.is.not.using.the.bandwidth.

reserved.for.it,.other.trac.types.may.use.the.remaining.reserved.bandwidth.

Custom

.queuing.must.be.congured.statically.and.does.not.provide.automatic.adaptation.for.chang-

ing

.network.conditions.

.IP.RTP.Priority.model.provides.a.strict.PQ.scheme.in.which.delay-sensitive.data,.such.as.voice,.

can.be.dequeued.and.sent.before.packets.in.other.queues..It.is.used.typically.on.serial.interfaces.in.

conjunction.with.CBWFQ.on.the.same.outgoing.interface..Trac.matching.the.range.of.UDP.ports.

specied.for.the.priority.queue.is.guaranteed.strict.priority.over.other.CBWFQ.classes:.packets.in.the.

priority.queues.are.always.serviced.rst.

.weighted.fair.queuing.(WFQ).approach.classies.trac.into.dierent.ows.based.on.such.charac-

teristics

.as.source.and.destination.address,.protocol.and.port.and.socket.of.the.session,.and.is.the.default.

Forwarded packets

Priority queuing system

Tail-drop

Queue 1

Queue 2

Queue 3

Hardware queuing

system

Hardware Q

Interface

Pre-emptive

scheduler

Queue 4

High?

Medium?

Normal?

Low?

FIGURE 19.4 Priority.queuing.system.

Tail-drop

Forwarded packets

Queue 1

Custom queuing system

Queue 2

Round

Robin

scheduler

Queue 16

Tail-drop

Hardware queuing

system

Hardware Q

Interface

Class 1

Class 2

Class 16

FIGURE 19.5 Custom.queuing.system.

Quality of Service 19-11

queuing.system.for.Ethernet.links..An.extension.is.CBWFQ.(Figure.19.6),.which.provides.support.for.

user-dened.trac.classes.

.classes.allow.specifying.the.exact.amount.of.bandwidth.to.be.allocated.for.a.specic.class.of.traf-

c.

.Taking.into.account.available.bandwidth.on.the.interface,.you.can.congure.up.to.64.classes.and.

control.distribution.among.them.

19.4 Special Considerations for Managing the Quality of Service

 e.way.to.specify.the.parameters.and.rules.that.control.QoS.for.IP.networks.is.using.soware.tools.and.

devices..It.will.depend.on.the.type.of.network,.the.magnitude.and.the.application.running.on.it.

Many

.times.it.is.only.necessary.to.apply.the.QoS.mechanisms.in.each.device,.case.by.case..But,.in.

many.others,.for.more.complex.and.big.networks,.the.management.is.done.using.dierent.kind.of.net-

work

.management.tools.as.HP.OpenView.or.Cisco.Works.. ese.tools.always.use.as.the.preferred.man-

agement

.protocol.the.well-established.simple.network.management.protocol.(SNMP).[24],.to.manage.

many.dierent.situations.in.a.network.(general.network.management.and.network.monitoring.tasks),.

some.of.them.being.probably.QoS.tasks.

Although

.they.are.not.the.only.devices.to.implement.the.QoS.techniques,.the.routers.(and.any.level.

3.switch.is.also.a.router.in.this.sense).are.the.most.frequently.used.ones..At.the.routers,.and.using.the.

real-time.data.from.the.packets.they.process,.the.QoS.statistics.are.calculated..A.consequence.that.must.

be.taken.into.account.is.that.we.must.size.correctly.the.needed.resources.for.the.router.with.its.QoS.

mechanisms.implemented.and.using.them..Also.we.must.be.consistent.and.apply.the.same.mechanisms.

for.every.router.in.the.network.

.the.routers,.there.are.other.special.considerations.to.do.about.QoS,.the.congestion.avoidance.fea-

tures

.and.the.high.availability.solutions.for.the.routers.being.two.of.the.most.important.ways.it.is.handled.

19.4.1 Congestion avoidance

Congestion.avoidance.techniques.monitor.network.trac.loads,.trying.to.anticipate.and.avoid.conges-

tion

.at.common.network.bottleneck.points..It.is.got.through.packet.dropping.by.using.more.complex.

techniques.than.simple.tail.drop.

When

interface

router

cannot

transmit

packet

immediately,

the

packet

queued.

Packets

are.aerward.taken.out.of.the.queue.and.eventually.transmitted.on.the.interface.

.the.arrival.rate.of.packets.to.the.outgoing.interface.exceeds.the.router.capability.to.buer.and.

forward.trac,.the.queues.increase.to.their.maximum.length.and.the.interface.becomes.congested..

Forwarded packets

WFQ + drop

Flow 1

Flow 2

Flow N

WFQ + drop

Hardware queuing

system

Hardware Q

Interface

Queue 1

Queue 2

WFQ

scheduler

Queue N

FIGURE 19.6 Class-based.weighted.fair.queuing.

19-12 Industrial Communication Systems

Tail.drop.[25].is.the.router.default.queuing.response.to.congestion..When.the.output.queue.is.full.and.

tail.drop.running,.all.packets.trying.to.enter.the.queue.are.dropped.until.the.congestion.is.eliminated.

and.the.queue.is.no.longer.full.

Tail

.drop.treats.all.trac.equally.and.does.not.dierentiate.between.classes.of.service.. e.tail.drop.

mechanism.is.not.a.good.scheme.in.environments.with.a.large.number.of.TCP.ows.or.in.any.environ-

ment

.in.which.selective.dropping.is.wanted.

Some

.of.the.worst.consequences.of.simple.tail.drop.mechanism.are

•

. With.congestion.in.the.network,.dropping.aects.most.of.the.TCP.sessions,.which.simultaneously.

back.o.and.then.restart.again,.provoking.inecient.link.use.at.the.congestion.point.

•

. TCP. starvation,. with. buers. temporarily. seized. by. aggressive. ows,. and. normal. TCP. ows.

experience.buer.starvation.

•

. It.is.possible.that.buering.introduce.delay.and.jitter.because.packets.are.stopped,.waiting.in.

queues.

•

. Premium.trac.is.also.dropped.because.of.the.inexistence.of.dierentiated.drop.mechanisms.

One

.of.the.approaches.for.avoiding.these.problems.is.the.random.early.detection.(RED).feature..RED.

[25].does.not.take.into.account.the.precedence.or.CoS,.it.simply.uses.one.of.the.single.threshold.when.

that.threshold.value.for.the.buer.lls..RED.start.to.drop.packets.randomly.(not.all.packets,.as.with.tail.

drop).until.the.maximum.threshold.is.got,.and.then.all.the.packets.are.dropped.. e.idea.is.that.the.

probability.of.dropping.a.packet.rises.linearly.with.the.increase.of.buer.lling.above.the.threshold.

RED

.is.very.ecient.only.with.TCP-based.trac,.because.it.takes.advantage.of.the.windowing.mech-

anism

.used.by.TCP.to.manage.congestion..As.a.consequence,.it.is.not.very.useful.when.the.trac.type.

is.not.TCP-based.

Other

.useful.mechanism.is.Weighted.RED.(WRED,.Figure.19.7).[25]..It.is.very.similar.to.RED.in.that.

both.dene.some.threshold,.and.that.threshold.starts.to.randomly.drop.packets;.but.WRED.is.CoS-

aware,

.meaning.that.a.CoS.value.is.added.to.each.of.the.thresholds.

When

.the.threshold.is.exceeded,.WRED.randomly.drops.packets.with.the.CoS.assigned..For.exam-

ple,

.with.two.thresholds.in.the.queue

•

. CoS.0.and.1.are.assigned.to.threshold.1,.and.the.threshold.set.to.40%.of.buer.lling.

•

. CoS.2.and.3.are.assigned.to.threshold.2,.and.the.threshold.set.to.80%.of.buer.lling.

.the.moment.that.buer.exceeds.40%.of.use,.packets.with.CoS.0.and.1.will.start.to.be.randomly.

dropped..More.packets.will.be.dropped.while.the.buer.use.grows..If.80%.is.reached,.packets.with.CoS.

Yes

Queue

full ?

FIFO queue

Calculate average

queue size

IP packet

WRED

Select

WRED

prole

IP precedence

DSCP

Minimum threshold

Maximum threshold

Maximum probability

denominator

Random

drop

Tail drop

Current

queue

size

FIGURE 19.7 Weighted.random.early.detection.mechanism.