In this paper we describe the adopted and implemented solution to provide secure communications over the extended area Ethernet network of the Polytechnic University of Catalonia (U.P.C.). The developed solution is not adapted to the current standards about security on local networks (IEEE-802.10, ISO 7498-2, etc.). This solution is based on the construction of a set of ciphering devices (CRYPTONETS), whose function is similar to the one carried out by a classic bridge, but incorporating ciphering facilities. Moreover, there is a Supervision and Administration Center (SAC), which takes care of the key renewal and System Management. The cryptographic algorithms used are the D.E.S. for the Ethernet frames ciphering, and the R.S.A., for key-management.

The development and the implementation of a security system in a local area network environment are presented. This system is based on an extended Ethernet network, but the methodology used is transferable to different kinds of LCNs and even metropolitan area networks (MANs), with some easy modifications. The adopted solution fulfills all the requirements that must fulfill any security protocol since: it provides cryptographic security services, it is an independent algorithm, it supports transparent operations for protected systems, it does not interfere with the operation of unprotected systems, it provides protocol support of key management independent of data security, and it provides optimal communication with unprotected systems. It also offers advantages such as flexibility, simplicity, low cost, and mobility.

An extended Ethernet LAN is built by connecting several Ethernet segments by means of suitable devices (repeaters, bridges, etc.). A common way to make this interconnection is through a main segment, called the backbone, that joins each of the departments (or, perhaps, building floors) within the owner premises. In this kind of network, data transmission in the backbone is very sensitive to either eavesdropping or manipulation. The implementation of a cryptographic system that protects transmission (providing for both confidentiality and integrity of transmitted data) in this kind of network is addressed. The operation of the proposed system and the specific troubles encountered in implementing it in the local network of the Polytechnic University of Catalonia are presented. An analysis of the functionality of the ciphering bridges is provided and their implementation is studied in detail. Finally, the more relevant results and conclusions are given.>

The implementation of a security system that caters to the needs of an operating network, the UPC NET, is presented. The security services that this system offers are confidentiality and authentication (origin authentication and data integrity) of data transmitted on the main segment of an extended Ethernet network. The system has been designed to specifically function in the extended Ethernet network of the Polytechnic University of Catalonia. The security system has the following characteristics: it provides cryptographic security services, it does not interfere with the operation of unprotected systems, and it supports transparent operations for protected systems.>

An implementation of a security protocol in an extended LAN environment is described. The protocol has a hierarchical architecture. At the first level, the session key is disposed of, in the second level there are the master keys, and at the highest level there are the public and private key of the manager and the CryptoNet's keys. The relations between them, the right time to do the keys' renewal, and the appropriate form in which to do it are also characteristics that make it possible to obtain security based on two very well known algorithms such as the DES and RSA.>