\chapter{Service Management}
\label{ch:service}

Growing services (such as e-commerce, web hosting etc.) are being deployed over an infrastructure that spans multiple control domains. These end-to-end services require co-operation in internetworking between multiple organizations, systems and entities. Service providers need to deploy interoperability, distributed scaleable architectures, integration and automation of network management systems. Management systems must make management easy and flexible to service providers. They must also make service providers  operations and end goals easier.

Service providers need to find new and effective ways to~\cite{b5}:
\begin{itemize}
\item Deploy services more quickly,
\item Deliver guaranteed services through service-level agreements (SLA),
\item Evolve from reactive network management to proactive service management, and
\item Reduce costs by automating network and service management.
\end{itemize}

Currently, there are no standard mechanisms to share selective management information between various service providers or between service providers and their customers. Such mechanisms are necessary for end-to-end service management and diagnosis as well as for ensuring service level obligations between a service provider and its customer or partners~\cite{b3}.

Security of services is not an absolute concept. Security of devices and networks must be compared to possible threats and risks. If the risks are high, the devices and the networks must be provided with more reliable secure properties. The network security influences also the security of the company, so they must be planned together. According to a committee of IETF (the Internet Engineering Task Force), the security services include~\cite{b12}:
\begin{itemize}
\item authentication,
\item confidentiality,
\item integrity,
\item non-repudication,
\item access control, and
\item availability.
\end{itemize}

In this report we examine authentication and authorization. Also billing and directories are discussed. Security devices, such as routers and firewalls, are discussed in chapter~\ref{ch:network}. 

\section{Authentication and authorization}

Almost all applications utilize user information and presume an authentication of users. Authentication means that a network user establishes a right to an identity, the right to use a name. Passwords, smart cards and certificates are used to authenticate a user. A user may have the rights to use more than one name and a user may have rights to use identities established by multiple organizations (such as universities and scholarly societies). Authorization is the determining whether an identity is permitted to perform some action, such as accessing a resource~\cite{b15}.

There might be an advantage if all the user information is available in same directory. All the applications could then use same information. Users have to log in only once to be able to use all the services and recourses~\cite{b17}.

\subsection{Requirements}

There are some basic requirements for authentication~\cite{b15}:
\begin{itemize}
\item access management solution needs to work at a practical level
\item the solution needs to be secure
\item it should make access easier, minimizing redundant authentication interactions and providing user-friendly information resources
\item it needs to scale
\item it needs to be robust
\item there should be a simple and well-defined (standard) interface between resource operator and licensing institution
\item it must be able to recognize the need for a user to access a resource independent of his or her physical location (for example, a user must be able to connect to the internet via a commercial ISP, a mobile IP link, or a cable television internet connection from home)
\end{itemize}

\subsection{Problems}

The basic access management problem is licensing agreements for networked information resources today. The situations where institutions agree to share limited-access are difficult. At present, most access to network information resources is not controlled on a fine-grained basis. There is a danger that by accommodating all the needs for fine-grained access management into the basic access management mechanisms will produce a too complex and costly system~\cite{b15}.

Management data is a problem in the current access framework. The problem is the conflict between private and public data. Most of the data have to be sorted out at the institutional policy level and it may involve making sacrifices in order to ensure privacy. Some institutions may be legally limited in their ability to collect certain management data.

Proxies and credential-based authentication (the user presents a credential  to the operator as evidence that he or she is a member of the user community) schemes seem to be viable. Proxy servers will become a focal point for policy debates about privacy, accountability and the collection of management information. Successful operation of a proxy server means that the user trust the licensee institution to behave responsibly and to respect privacy.

A cross-organizational authentication system based on a credential approach has the advantage of greater transparency. Resource operators can have a higher level of confidence in the access  management mechanisms and a greater ability to monitor irregular access patterns. Privacy, accountability and collection of management statistics must be taken up for discussion among a larger group of parties.

IP source filtering does not seem to be a viable solution, although it may be very useful for some niche applications, such as supporting public workstations. It can be used more widely, but it cannot support remote users flexibly in its basic form. Most real-world access management systems are going to have to employ multiple approaches and IP source address filtering is likely to be one of them~\cite{b15}.

\section{Billing}

Internet is becoming able to support heterogeneous applications and services to a diverse user community. Delivered services must be billed. In the future we want to know, who is using the network, what the network is being used for and when the network is being used~\cite{b14}. Some pricing mechanism will be necessary in order to manage the quality of services (QoS). Accounting and billing systems must be reliable, scaleable and high performance, offering flow-through operation from the other systems.

\subsection{Payment mechanisms}

Internet payment mechanisms can be grouped into three classes: electronic currency systems, credit-debit systems and systems based on credit card numbers~\cite{b21}. Collecting and rating usage, tracking services, managing inventories and reconciling invoices are key features of accounting systems~\cite{b14}.

The safety issues are under discussion. Some payment mechanisms are totally anonymous and payers can not be tracked (such as E-cash --- electrical purse, where you load money and pay with it). The principal advantage of electronic currency is its potential for anonymity. The disadvantage is the need to maintain a large database of past transactions to prevent double spending.

In the credit-debit model (like NetCheque system), customers are registered with accounts on payment servers. Customers authorize charges against those accounts. The credit-debit model is audible. Once a payment instrument has been deposited, the owner of the debited account can determine who authorized the payment, and that the instrument was accepted by the payee and deposited~\cite{b21}.

Some payment mechanisms are based on credit cards (such as Cybercash). Information is often shared with owner of the credit card, payment service provider and credit card company. The owner of the credit card does not need to give his credit card number to the merchant. The information of the payments are collected on the server of the payment service provider. A customer's credit card number is also encrypted using public key cryptography. The advantage is that the customer does not need to be registered with a network payment service; all that is needed is the credit card number.

\subsection{Demands of the electronic payment}

Internet payment system should be secure, reliable, scalable, anonymous, acceptable, flexible, convertible, effective, ease to integrate with applications and ease to use. An anonymity is more important in some communities or for certain kinds of transactions, than they are in other communities~\cite{b21}.
\begin{itemize}
\item \textbf{Security}: The infrastructure must be usable and resistant to attack in an environment where modification of messages is easy.
\item \textbf{Reliability}: The infrastructure must be available and should avoid failures.
\item \textbf{Scalability}: The payment infrastructure must be able to handle the addition of users without suffering a loss of performance.
\item \textbf{Anonymity}: For some transactions, the identity of the parties to the transaction should be protected. Where anonymity is important, the cost of tracking a transaction should outweigh the value of the information that can be obtained by doing so.
\item \textbf{Acceptability}: A payment instrument must be accepted widely.
\item Customer base: The acceptability of a payment mechanism affects the size of the customer base.
\item \textbf{Flexibility}: Alternative forms of payment are needed. The payment infrastructure should support several payment methods including credit cards, personal checks, cashier's checks and anonymous electronic cash.
\item \textbf{Convertibility}: There will be several forms of payment, providing different trades.
\item \textbf{Efficiency}: Royalties for access to information may generate frequent payments for small amounts. Applications must be able to make these payments without noticeable performance deterioration.
\item \textbf{Ease of integration}: Applications must be modified to use the payment infrastructure in order to make a payment service available to users.
\item \textbf{Ease of use}: Users should not be constantly interrupted to provide payment information and most payments should occur automatically. Users should be able to limit their losses and monitor their spending.
\end{itemize}

Threats of misusing electronic currency can lead to the running into dept (unpaid bills), forgeries, not allowed payments on behalf of another person, double purchases (order twice --- pay once), refusal of payments and unsuccessful deliveries.

\subsection{Future billing requirements}

Some of the requirements of new billing systems include:
\begin{itemize}
\item Real-time react to market activities
\item Flexible billing formats and media to meet customer demands
\item Flexible rating engine that allows discounting 
\item Integrated billing, which includes charges from third-party providers
\item Well-defined interfaces to allow easy integration and data sharing between business systems and the billing system~\cite{b29}.
\end{itemize}

\section{Directories}

Directories are logical data repositories to save and to search for information. Directory services are important in helping users to find information on a network. Directory services must be reliable and secure in performance. Directories are used for example in saving personal data with telephone numbers and e-mail addresses. The data is often saved in logical tree form.

Special programs on the Internet have basic directory functions (mapping names to addresses and vice versa). The Domain Name System (DNS) provides these directory services on the Internet by mapping domain names to IP addresses and providing e-mail routing information for domain names. Security is another task of the directory.

A directory is a logical place for usernames and passwords as well as public-key data such as certificates and keys. Another use of directoies is yellow-pages functions, where searches find all entries in the directory where attributes satisfy some search criteria. Policy-based networks (PBNs) and guaranteed Quality of Service (QoS) applications are also driving the demand for directories~\cite{b13}.

There is a need to consolidate directory data. When intranet systems are expanded to extranet-systems, there is a problem combining different type of directories and databases. A standardized model of directories will help this integration. Decreasing directories means cost savings, higher quality data and lower security hazards~\cite{b13}. The development of an application is also easier if all the information is available in directories using standardized protocols~\cite{b17}.

