Design, implementation and security of a typical educational laboratory computer network

Abstract

POKORNÝ MARTIN, ZACH PETR: Design, implementation and security of a typical educational laboratory computer network. Acta Universitatis Agriculturae et Silviculturae Mendelianae Brunensis, 2013, LXI, No. 4, pp. 1077-1087 Computer network used for laboratory training and for diff erent types of network and security experiments represents a special environment where hazardous activities take place, which may not aff ect any production system or network. It is common that students need to have administrator privileges in this case which makes the overall security and maintenance of such a network a diffi cult task. We present our solution which has proved its usability for more than three years. First of all, four user requirements on the laboratory network are defi ned (access to educational network devices, to laboratory services, to the Internet, and administrator privileges of the end hosts), and four essential security rules are stipulated (enforceable end host security, controlled network access, level of network access according to the user privilege level, and rules for hazardous experiments), which protect the rest of the laboratory infrastructure as well as the outer university network and the Internet. The main part of the paper is dedicated to a design and implementation of these usability and security rules. We present a physical diagram of a typical laboratory network based on multiple circuits connecting end hosts to diff erent networks, and a layout of rack devices. A er that, a topological diagram of the network is described which is based on diff erent VLANs and port-based access control using the IEEE 802.1x/EAP-TLS/RADIUS authentication to achieve defi ned level of network access. In the second part of the paper, the latest innovation of our network is presented that covers a transition to the system virtualization at the end host devices -inspiration came from a similar solution deployed at the Department of Telecommunications at Brno University of Technology. This improvement enables a greater fl exibility in the end hosts maintenance and a simultaneous network access to the educational devices as well as to the Internet. In the end, a vision of a system of virtual machines preparation and automated deployment tailored for our needs is briefl y outlined. computer networks, network security, education, laboratory network, operating system virtualization Laboratory of computer networking at the Department of Informatics (Faculty of Business and Economics, Mendel University in Brno) was founded in 2009 in order to support courses specialized in computer networking, network security and operating systems taught for bachelor and master degrees, and to provide an experimental environment for fi nal thesis and for networking or security tests. The equipment of the laboratory covers basic areas in routing and switching, network security, wireless networking, VoIP, and server virtualization.User requirements, design, implementation and maintenance of an educational network dedicated to laborat...

Controlling Multiple Virtual Machines in Computer Classrooms

“…There are several types of virtual machines, their platform and so ware equipment depends on the courses for which they are intended. Detail description of possible virtual machine adjustment is described by Pokorný and Zach (2013).…”

“…On the other hand, a virtual machine management system should be employed to cover the administration of the virtual machines. The proposed management system of computer classroom is designed especially for computer network laboratory at the Department of Informatics (Faculty of Business and Economics, Mendel University in Brno) founded in 2009 in order to support courses specialized in computer networking (Pokorný and Zach, 2013). The proposed system can also be used in other university computer classrooms using virtualization without major modifi cations.…”

“…The management of multiple operating systems on the one workstation was very time consuming, even when operations were trivial, more details about the previous solution was described by Pokorný and Zach (2013). A method of virtual image cloning was used to apply changes on all workstations in the past.…”