Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Does the Network Matter?: Page 2 of 3

Distributing intelligence is fine within an enterprise, but not on the WAN. The whole point of the Internet is that it's simple and flexible, whereas the new vision of an intelligent network looks suspiciously like the old PSTN--dumb endpoints accessing expensive and restricted services. That's good for carriers because it gives them more opportunity to add value (and bill accordingly). But for the rest of us, it turns the network cloud into a black box, and one under someone else's power.

The most frightening example is access control. Inspired by Wi-Fi switches, a large number of vendors are promoting 802.1x authentication for wired Ethernet. But 802.1x is just the start. Cisco, Microsoft, and others want to put software agents in PCs that will supposedly let switches verify their state, only allowing access to clients with a particular software configuration. In the long term, they plan to replace the software agents with harder-to-hack Trusted Computing chips.

This is particularly dangerous on public networks. If it works, it'll allow ISPs to control their customers' choice of hardware and software. (And don't have faith in the free market to stop them. Government officials have gone as far as to suggest requiring ISPs to use such a system, prompted by their usual cyberterrorist paranoia.) The idea seems much more useful in private networks, but wireless 802.1x suggests it won't be.

While 802.1x works well in Wi-Fi networks that consist only of Windows XP laptops, it needs client software that can't run on more exotic devices such as bar-code scanners. And the problem isn't just with legacy hardware: No Wi-Fi phone supports 802.1x yet.

Keep in mind that 802.1x is a relatively simple, well-documented standard whose underlying protocol hasn't changed since 1998. If the latest overhyped wireless gadgets can't run that, what chance is there that printers, photocopiers, and everything else with an Ethernet port will be able to run a proprietary software agent? The only way to fully implement agent-based access control will be to restrict the network to Windows PCs--the very things most likely to be infected with malware.