Network security: is it so costly?

As long as networking of computers was confined to the local area, the cost of connectivity (the physical layer or Layer 1 in the OSI model) was insignificant (about 5% of the total network cost). However, with the advent of enterprise-wise integrated information systems (IIS) such as various enterprise resource planning systems (ERPs), and the consequent need for continuous WAN computing, the cost of the physical layer or connectivity has assumed significant proportions (almost 60-70% of the total network cost). It has, therefore, become a matter of serious concern for all multi-locational organizations (MLOs).

The most important aspect of networks designed for WAN computing is the need for 100% security of the centralized or distributed databases linked together by the WAN. There cannot and must not be any compromise on security.

Another point is that the operating cost of pure data or computer connectivity is added to the cost of MLOs. To reduce this additional cost burden, MLOs tend to take some risks, allured by competing offerings by different ISPs. They apparently save some money in setting up and operating cost of their pure data WANs by going along the VPN route, but at the risk of impairing the security of their databases at different organization locations.

The VPN route

How secure is VPN?

In the VPN network, you will see that the router ports of your VPN network has continuous physical access through the tier-1 IP switch associated with the Core or Edge router at the Internet backbone node in the city to all the public domain networks like the PSTN, ISDN, and broadband. Once such access is available continuously, a professional hacker can break into your network by cracking through the CUG (closed user group) code, which separates your VPN from that of others and the public domain networks. This makes VPN security vulnerable to hacking.

Hence, from both the cost and security angles, the P2P data network appears to be superior to the VPN networks. In this context, it is, therefore, unwise on the part of network planners to put their databases in jeopardy by opting for the VPN WAN connectivity with a mistaken belief that it is less expensive and guarantees security of databases.

In the above two examples, only pure data connectivity is considered. Pure data network add to the present telecommunications costs of a MLOs. Thus, if the present inter-locational telecom (telephony and fax) cost is X, then the total cost of communications between MLO locations will be as under for the two cases.

The availability of 24x7 point-to-point leased line connections between MLO locations makes it possible to consider using this for all kinds of inter-locational communications of the MLO-speech, fax, data (RA, FTP, Mail), voice and voice-data conferencing, particularly if the X figure is large.

Integration approach

Integration of the three different modes of communication, speech, fax, and data, have been attempted for almost fifteen years with varying degrees of success with the advent of digital leased lines. The first was fixed channel multiplexing (FCM) where channels were dedicated for speech, fax, and data. While this worked well the users felt that when any of the channels were not being used, the bandwidth associated was being wasted. The next development was adaptable bandwidth multiplexing (ABM) where the multiplexer allowed the use of one channel bandwidth currently unused by another channel to increase the latter's bandwidth and consequently throughput. While this method eliminated the problem of wasted bandwidth, it brought with it the problem of inter-channel interference. If voice was given priority, the data call would drop or slow down the moment a voice call was initiated. If data was given priority, the voice call would drop as soon as a data call was initiated. The next development was to digitize the voice and send the voice packets continuously in queue with the data packets through the WAN to the intended destination. To send the originating packets to the desired destination and to receive back the response packets to the telephone which initiated the call, it is necessary to break the digitized speech into small core packets and add a header carrying the address of the destination location, the telephone trunk it has seized, the number of the telephone called. Similarly, the originating address will have to be given in the form of a tail packet. This additional information of header and tail packets increases the bandwidth requirement in VoIP. Typically to set up a single voice call using VoIP, the bandwidth consumed will be 60 kbps (toll quality) or 36/40 KBPS (near toll quality). Thus, while VoIP eliminated the problem of wasted bandwidth of FCM, and inter-channel interference of ABM, it brought with it a new problem of increased bandwidth requirement. In today's telecom scenario, more bandwidth means more cost. Thus, the advantage that could accrue in reducing communication costs through integration of speech, fax, and data over P2P leased line networks, gets nullified by the increased bandwidth requirement. The quality of speech is also not up to the mark and in many cases where VoIP has been implemented people tend to use the circuit switched public telephone network or their mobile phones in preference to the available VoIP phone. 

It is a well-established fact that for any real time communication like speech, fax, video, a synchronous communication link is ideal. This is best achieved through circuit switching. It is also a well-established fact that an asynchronous communication link is ideal for heavy data traffic, and is extensively used for IP data networks like the Internet.

Extensive research over the last 17 years has produced a networking system, which uses circuit switching (for speech and fax communications) and packet switching (for data communications) using channel splitters at either end of a digital leased line. An EPAX converts the circuit switched trunks into universal channels, which may be used for speech, fax, and data alternately. There is, therefore, no wasted bandwidth. Further, the channel splitters act like fixed channel multiplexers, and therefore there is no inter-channel interference. The system also uses analogue circuits to bring data from low data volume locations like residences, guest houses, small offices, etc by terminating these into E&M trunks or long line extensions on the EPAXs, and leading this to the IP data network through analogue extensions, high speed dial-up modems, and multiple serial port cards sitting the PCI slots of any server connected to the LAN. The universal channels have individual channel bandwidths of 12.8 kpbs, and since circuit switching I involved, no head and tail packets are required. Thus, the bandwidth required for speech and fax integration is not very large, and total operating cost of these networks is such that considerable savings can be affected in the MLOs total present telecom and datacom costs.

Any network will be used only if it is easy to use and easy to access. Thus, all people who need to speak to people in other locations frequently must have a NET telephone. These are simple analogue phones costing Rs 600-1000 and not as expensive as the IP phones, which cost around Rs 10,000 each. Thus, they may be given to all people who need to speak to other locations. Similarly, the NET fax machines should be located in such a location that those who need to use it frequently do not have to walk long distances.

In our 10-location MLO, let us assume that, at central location, fifty people will need NET phones and the building is large enough to warrant ten NET fax machines for ease of access.

Using these and the earlier computer numbers, we have designed an integrated voice/fax/data network.

The author is the MD at MIDAS Automation and Telecommunications

In the P2P network, the leased lines are laid out from one company location to another, bypassing all the public domain PSTN switches. Hence, no MLO outsider can access the P2P leased lines and the network built with these. This ensures 100% security from external intrusion.Let us see how much money MLOs can save by taking the VPN route. Let us assume that the data load impinged on the WAN at each location is 62.2 kbps. This would be the load impinged by twenty-eight computers in each location connected to the LAN with mail and FTP load of 0.22 kbps per computer, and assuming that 25% of the computers will be simultaneously using the Remote Access facility from each location. In the central location, the number of computers may be assumed to be about 100. While the mail and FTP load from these computers get impinged on the WAN, the Remote Access load does not get impinged on the WAN, as the databases are in the same location.