Chapter 1 — Computing and service architecture

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The case"]
  N2["1.2 Clients, servers and services"]
  N3["1.3 Who controls the keys"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The case"]
  N2["1.2 Clients, servers and services"]
  N3["1.3 Who controls the keys"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 The case]
    |
    v
[1.2 Clients, servers and services]
    |
    v
[1.3 Who controls the keys]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) describe the services of a logistics company and where cryptography sits inside them; (2) separate clients, servers and managed services; (3) record who controls each key.

1.1 The case

Tomás Reyes is a first-year student in the eighteen-month technical programme at the fictional Eastbrook Technical Institute. His supervised placement is with the IT operations team of the fictional Lumen Freight Logistics, a regional carrier with three depots, a customer parcel-tracking portal, handheld scanners for drivers and nightly file exchanges with partner warehouses. His mentor is senior technician Priya Nandakumar. Every person, system, address and figure in this book is synthetic. A technician diagnoses failures, configures controls and proves that the controls work, so Tomás will spend most of his time reading configurations and logs rather than designing algorithms, and he will never write his own cipher.

1.2 Clients, servers and services

Priya asks Tomás to sort the company's systems into three groups. Clients include driver handhelds, office laptops and the browsers customers use. Servers include the tracking portal, an internal database and the file-transfer host. Managed services include the email platform, the payment processor and the cloud backup store. Cryptography appears in all three groups: laptops use full-disk encryption, the portal terminates TLS, backups are encrypted before upload and the payment processor signs callbacks. Tomás learns that the same algorithm, such as AES, can be configured well on one server and badly on another, so the inventory must record configuration and not only names.

1.3 Who controls the keys

For each system Tomás adds a column called key owner. On company servers the operations team generates and stores private keys, so a mistake there is a Lumen problem to fix. On managed services the provider holds the keys, and Lumen can only choose settings the provider exposes and check contracts and audit reports. Handhelds are a mixed case: the device vendor installs a root certificate list, while Lumen installs a client certificate for the depot Wi-Fi. Knowing the owner tells Tomás who to call when something breaks and stops him wasting a night changing a setting that only a supplier can change.

Worked example

Tomás builds a twelve-row table of Lumen systems with columns for type, cryptographic function and key owner, and marks the backup store and payment processor as provider-controlled.

Synthetic case. Lumen Freight Logistics, Eastbrook Technical Institute, Tomás and Priya are invented.

Errors and limits

An inventory is a snapshot; new systems appear without notice. Provider-controlled keys still create Lumen risk through contracts and outages.

Exercises

• EX001 — Placement role. What is Tomás's job at Lumen, in one sentence?
  Show marking criteria

  Rubric: 3 = diagnose failures, configure controls and verify they work; not design algorithms;; 2 = partial role;; 1 = says he designs ciphers;; 0 = none.
• EX002 — Grouping the systems. Put the driver handheld, tracking portal and payment processor into client, server or managed service.
  Show marking criteria

  Rubric: 3 = handheld client; portal server; payment processor managed service;; 2 = two correct;; 1 = one correct;; 0 = none.
• EX003 — Same algorithm twice. Why record configuration and not only the algorithm name?
  Show marking criteria

  Rubric: 3 = the same algorithm can be configured well on one host and badly on another;; 2 = mentions settings;; 1 = lists names only;; 0 = none.
• EX004 — Key owner value. How does knowing the key owner help during an outage?
  Show marking criteria

  Rubric: 3 = tells who can fix it; avoids changing settings only a supplier controls;; 2 = who to call;; 1 = no benefit;; 0 = none.

Synthesis

A useful service architecture map names each system, its cryptographic job and who holds the keys.

Continue studying — chapter 01 of 18

← Course home · Course chapter index · Chapter 02 (draft) →