90

CHAPTER 7

AUTHENTICATION EMPLOYING KERBEROS

The continuing need for private communication in public world drives

the development of communications security technology and forces us to follow

stringent measures and policies to achieve appreciable privacy. Security is an

inherent part of any communication systems, be it mobile based or computer based

or human based. Security not only depends on the communication systems but also

on the applications utilizing these systems. The level of security to be achieved

depends on the sensitivity of applications and the frequency with which attempts

will be on to break into these systems by adversaries. One such extremely sensitive

area where communications security, device security, and network security must be

ensured to a great extent is in defense.

Though the activities of enemies and adversaries, against a nation’s

defense are diverse, major concentrations are towards interrupting the military

communication network, intercepting the communications across different military

entities, personifying as authenticated users and sending messages to different

entities, modifying the intercepted message and retransmitting the same. These

aforementioned actions undoubtedly will create an insecure environment in the

military. Enemies breaking into military communications and military security

technologists developing security solutions are circular processes. Hence in this

chapter we concentrate on the general security problems and measures available to

mitigate them with respect to communications in section 7.1. Section 7.2 focuses on

the importance of communication security and authentication within and among

military systems. Major thrust on employing Kerberos authentication protocol in the

presence of defense private cloud and cloud gateway connecting military WSNs and

91

military personnel in the cloud, is provided in section 7.3. Section 7.4 deals with the

analysis of response times for authentication in local realm and cross realm through

different configurations of cloud based military entities leading towards Quality of

Service (QoS).

7.1 OVERVIEW OF SECURITY PROBLEMS AND SECURITY

SOLUTIONS

Before going to the description on how I have implemented a modified

form of Kerberos in the Military System Security, this section provides a

fundamental understanding and classification of various types of security attacks,

security mechanisms to prevent, detect or recover from the attacks and services that

enhance the security of the data processing systems and the information transfers of

an organization.

Based on X.800 and RFC 2828, security attacks are primarily classified

into active and passive attacks. Operation of system resources gets affected and they

get altered during active attacks. Active attacks get further divided into the

following sub categories:

a. Masquerade

b. Replay

c. Modification of messages

d. Denial of services

When data stream gets modified or a false stream of data gets added in

the communication channel before reaching a specific destination it is considered

that an active attack has taken place. When one entity pretends to be a different

entity it is normal to consider it as a form of MASQUERADE. The passive capture

of a data unit and its retransmission to produce an unauthorized effect is known as

REPLAY ATTACKS. A portion of a legitimate message gets altered or original

92

message segments get reordered or delayed, resulting in the MODIFICATION OF

MESSAGES. When the communication services to an authorized/authenticated user

is denied, it is known as Denial of Service (DoS).

Passive attacks attempt to learn or make use of information from the

system but do not affect system resources. The very purpose of passive attack is

eavesdropping into transmissions. Majority of passive attacks can be classified

under the categories of release of message contents and traffic analysis.

Apart from providing an overview of security attacks, X.800 also

specifies different security mechanisms to mitigate various attacks. These security

mechanisms are broadly classified into specific security mechanism and pervasive

security mechanisms. Specific security mechanisms are techniques incorporated at

appropriate protocol layers. Popular specific security mechanisms include

encipherments, digital signature, access control, data integrity and authentication

exchange. Encipherment converts intelligible data to an unintelligible one. Proving

the identity of the source and protecting against forgery is the applications of digital

signature. Release of message contents and traffic analysis can be mitigated by

access control mechanisms that enforce access rights to resources. Data integrity

mechanisms assure the integrity of a data unit or stream of data units. Source and

destination can prove their identity with the help of authentication exchange

mechanisms. Pervasive security mechanisms are not specific to any particular

protocol layer. These mechanisms include the following:

a. Trusted functionality

b. Security label

c. Event Detection

d. Security Audit trail

e. Security Recovery

93

Security service is defined as a service provided by a protocol layer of

communicating open systems which ensure adequate security of the systems or of

data transfers. Generally, security services are classified under five categories and

fourteen specific services are listed based X.800 specifications. Security policies are

implemented using security services and security services are implemented using

security mechanisms. Figure 7.1 provides relationship between security policies,

services and mechanisms. Figure 7.2 gives a clear view on the categorization of

security services and different services under various categories.

Figure 7.1 Security Policies, Security Services and Security Mechanisms

Table 7.1 as provided by [89] indicates a meaningful relationship

between security services and security mechanisms. Hackers and intruders breaking

into communication systems and security technologists and security management

professionals developing solutions and implementing policies are continuous

activities. This makes quite evident that any security mechanism that is developed

today for a particular threat, attack or vulnerability make become unsuitable for

tomorrow.

94

Figure 7.2 Categorization of Security Services

Hence, the work on developing foolproof security solutions is a never

ending action. Having provided a clear notion about security attacks, services and

mechanisms in this section, it is very apt to place our discussion on the importance

of communications security and authentication within and among military systems

and mechanisms that are available to enhance the security of different heterogeneous

devices in the military in the next section.

95

Table 7.1 Relationship between Security Services and Mechanisms

Mechanism

Service E

ncip

herm

ent

Dig

ital

Sign

atur

e A

cces

s C

ontr

ol

Dat

a In

tegr

ity

Aut

hent

icat

ion

Exch

ange

Traf

fic

Padd

ing

Rou

ting

Con

trol

Not

ariz

atio

n

Peer entity authentication

Y Y Y

Data origin authentication

Y Y

Accesscontrol

Y

Confidentiality Y Y

Traffic flow confidentiality

Y Y Y

Data integrity Y Y Y

Non repudiation Y Y Y

Availability Y Y

7.2 COMMUNICATIONS SECURITY IN MILITARY SYSTEMS

Military communication systems are always characterized by the

presence of sensitive information. This information when obtained by the

adversaries proves to be a major threat for the security of a nation. Hence, efforts are

continuously on to maintain and improve the communications security of these

defense systems. Moreover, defense systems are characterized by heterogeneity in

the type of devices used for command and control operations. In order to account for

the importance of communications security within and across multiple

heterogeneous military systems, this section deals with the variety of methodologies

and techniques used to achieve the same.

96

Reference [90], deals with the communications security operations

utilized in the military, primarily the cryptographic and transmission security

portions. Communications security operations are protective measures taken to deny

unauthorized persons, telecommunications information. An authentication system

protects a communication system against the acceptance of fraudulent transmissions.

In a tactical environment, everyone who communicates requires some form of

authentication. Good authentication procedures contribute to combat survival and

effectiveness, because they aid in establishing the validity of a transmission,

message or originator. Proper authentication techniques prevent enemy from posing

as a friendly station. When authentication procedures are implemented in military

systems, trade off has to be achieved such that effective communications are

maintained without harassment of friendly communications. Reference [90], states

that the most commonly used authentication mechanisms in military are challenge-

reply and transmission authentication. The primary difference between the two is

that the former requires two way communications and the latter does not. But

challenge reply authentication is simple and flexible compared to the transmission

authentication. Reference [90], provides information on the use of codes for tactical

communications. A code is a language substitution system that transforms plain

language of irregular length, such as words and phrases, into groups of characters of

fixed length. In military systems, tactical communications are performed using

security codes and brevity codes. When a code hides meaning from another party, it

is called as a security code. A code that shortens transmissions is called as a brevity

code.

Reference [91], states the transition of DoD in the perspective of

authentication using a combination of three pillars of authentication namely,

“something you know, something you have or something you are”. Previously,

authentication in DoD information systems are carried out using username and

password or Personal Identification number (PIN) only (something you know). In

this modern technological era, the military is implementing more advanced

authentication procedures using the Common Access Card (CAC) [something you

have] and biometrics (something you are). Though, the combination of CAC and

97

biometrics have some obstacles in the implementation, with time and technology

improvements military can use combinations of PIN, CAC and biometrics to

provide authentication for its systems. Reference [92], proposes a new multi tier

adaptive military MANET security protocol using hybrid cryptography and

signcryption. Reference [92], deals with securing military MANET communication

from the perspectives of cryptographic methods used in MANETs, hybrid key

management protocols and structural organization of the military MANETs.

Reference [93], requires the importance of secure, integrated and

efficient networking in Digital Battle Fields (DBFs), which may be comprised of

various critical networking components. MANETs are ideal for instant

communication in both military and civilian applications. Hostile environment

operation and infrastructure less characteristics of MANETs make them susceptible

to various types of attacks. A secure multi cast concept to provide instant secure

communication in a Digital Battle Field (DBF) is proposed in [92]. In [94], [95],

two tiered Unmanned Aerial Vehicle-Mobile Backbone Networks (UAV-MBN)

have been proposed for DBFs utilizing the heterogeneous structure of military

MANETs, which significantly facilitates key management for secure

communication.

Reference [96], deals with Packet Level Authentication (PLA) in military

networks. PLA resembles the verification procedures used to check the authenticity

of money. In PLA, any node shall be able to verify the authenticity of an IP packet

using pre defined security procedures, by being source independent. PLA also

detects illegitimate, erroneous, duplicated and delayed packets in every router and

the destination. PLA provides for mitigating denial of service attacks that are based

on spoofing/forging IP packets and copying or manipulating legitimate IP packets.

The PLA header is added to every IP packet and takes advantage of standard IPv6

header extension techniques. Figure 7.3 given below provides details on different

fields of PLA header added to an IP packet for authentication purposes.

98

Figure 7.3 PLA Extension header

Reference [97], identifies eight requirements of strong authentication in a

military MANET for a tactical scenario. It also proposes two approaches to resolve

strong authentication issues in military MANETs, one based on Public-Key

Infrastructure (PKI) and the other based on Identity Based Encryption (IBE). These

approaches utilize offline key generation and integrate user and device

authentication for access to tactical MANETs. The various requirements for

authentication in tactical MANETs as given in [97] are as follows:

a. Strong Authentication

b. Easy to Use

c. Scalable

d. Low Latency

e. Low Control Overhead

f. Support Re-authentication

g. Support Revocation

h. Interoperable

99

Figure 7.4 depicts the flow chart for strong authentication process

describing the six steps.

Figure 7.4 Six Steps of a Strong Authentication Process

To summarize, this section deals with the security of military

communication systems using different tactical scenarios. From these discussions it

is quite evident that most of the works related to security are dependent on situations

and scenarios. Hence, they cannot be applied to all defense structures.

7.3 AUTHENTICATION, COMMAND/DATA CONNECTIVITY IN

OUR CONCEPTUAL DEFENSE STRUCTURE

In this thesis, we are conceptualizing the use of cloud technology along

with Wireless Sensor Networks deployed for military and other essential purposes.

Private cloud, one of the deployment models of cloud computing is integrated with

military WSNs. Security has always been a concern in military communications.

100

The integration of private defense cloud with WSNs has increased the scope of

mandatory operations and also the risk of security threats and vulnerabilities.

Discussion on the integration of private defense cloud with military WSNs

presented in chapter 4 is expanded here based on Figure 7.5, to provide rigid

authentication procedures with Kerberos.

Figure 7.5 Authentication, Command/ Data Connectivity

Sensor nodes deployed for border patrolling send periodical and event

based messages to Cluster Head1 (CH1) present in our territory. In addition, CH1 is

assumed to send highly prioritized packets with priority set to HIGH to the cloud

gateway. Cloud Gateway that lies at the heart of the defense structure, is logically

partitioned to perform two different functions namely authentication and

information dissemination (functional). Packets that arise out of Cluster Head2

(CH2) and Cluster Head3 (CH3) are set with priority value LOW. Packets are

101

provided with priority values by the source of generation. When the source which

creates packets gets authenticated at the cloud gateway, then the packets are allowed

to enter the gateway and then routed to the appropriate military data center server,

for corresponding services. Every sensor node will be provided with a unique node

ID which shall be utilized during authentication procedures. This unique node ID

shall be assigned from a database of random IDs by one of the data center servers.

The method of assigning node ID applies to cluster heads also. When military

personnel at different levels of military hierarchy wants to communicate with the

immediately preceding and succeeding level, those personnel should get

authenticated through the cloud gateway.

In a nutshell, authentication procedures followed at the cloud gateway

happens for node level authentication from the military WSNs, to utilize the services

of military data center servers. Next, authentication procedures are followed at the

cloud gateway for military personnel level authentication to transmit messages to

the soldiers in the battlefield and to the personnel present at either side of their own

levels.

Kerberos authentication protocol is used to provide rigid authentication

mechanisms, since it can provide authentication effectively at the levels of users,

client systems, servers and applications. For authenticating sensor nodes at cloud

gateway, using Kerberos, cloud gateway houses the Kerberos Server (KS). Since

Gateway is a single system, Kerberos server is a integrated system of Authentication

server (AS) and Ticket Granting Server (TGS). Sensor nodes are considered to be

client systems and Gateway-Functional is considered to be a server that provides a

service of receiving packets after authentication. Cluster heads transmit the packets

from their cluster members to the cloud gateway. The authentication of sensor nodes

is left to the cluster heads. Here in this authentication method using Kerberos, we

require the cluster heads to get authenticated at the cloud gateway-Authentication

before packets from them are allowed to enter Cloud Gateway-Functional.

102

The following equations facilitate the understanding process of how

authentication takes place in single realm where nodes, cluster heads and cloud

gateway are present in an area of few sq.kms:

CH-Cluster Head

GWKS- Gateway Kerberos Server

GWFS-Gateway Functional Server

CH�GWKS : Options||IDCH||RealmCH||IDGWKS||Times||Nonce1 (7.1)

GWKS�CH :

RealmCH||IDCH||TicketGWFS||E(KCH,GWKS,[KCH,GWFS||Times||Nonce1||RealmGWFS||IDG

WFS])||E(KCH[KCH,GWKS]) (7.2)

TicketGWFS=E(KGWFS[Flags||KCH,GWFS||RealmCH||IDCH||ADCH||Times])

a. Exchanges between CH and GWKS to obtain TicketGWFS

CH�GWFS : Options|| TicketGWFS||AuthenticatorCH (7.3)

AuthenticatorCH=E(KCH,GWFS,[IDCH||RealmCH||TS1])

GWFS�CH : E(KCH,GWFS[TS2|| Subkey|| seq#] (7.4)

b. Cluster Head/Gateway Functional Server Authentication Exchange to obtain

service

Authentication of cluster heads at Cloud Gateway follows two different

parts namely, i) exchanges between cluster head and gateway Kerberos server and

ii) cluster head/gateway functional server authentication exchange to obtain service.

103

Equation (7.1) indicates a request from the cluster head to gateway

Kerberos server in order to receive valid ticket for obtaining required services from

gateway functional server. This request consists of identity of cluster head, identity

of gateway Kerberos server, realm in which cluster head is present and the

timestamp of generation of the request along with options.

Equation (7.2) indicates how a ticket for cluster head to obtain services

from gateway functional server is issued by gateway Kerberos server. This message

contain the actual ticket, unique key used for communication between cluster head

and gateway functional server encrypted using the key that is known to cluster head

and gateway Kerberos server alone. The key that is known to cluster head and

gateway Kerberos server is encrypted using the key of cluster head which is known

to cluster head only. The key that is to be shared only among the cluster head and

gateway Kerberos server is generated every time when authentication requests are

received from the cluster heads. Timestamp is added at appropriate places to check

the life and validity of the request and reply.

Equation (7.3) denotes the process of requesting the service from

gateway functional server by the cluster head through providing necessary

credentials such as ticket for gateway functional server issued by gateway Kerberos

server, and authenticator message which contains identity of cluster head and realm

of cluster head encrypted using the key that is known to cluster head and gateway

functional server alone. This key is also present in the ticket for gateway functional

server which encrypted using the key of gateway functional server which is known

to it and gateway Kerberos server.

Equation (7.4) indicates the issuance of subkey for further

communication between cluster head and gateway functional server after

verification of the credentials. Similarly, for authenticating communication between

military personnel at adjacent levels, we consider again gateway to house in

Kerberos Server, source initiating communication to be client and destination

receiving the message to be server.

104

The authentication of military personnel at one level at the cloud

gateway for transmitting messages to any of the adjacent level of personnel obeys

the following equations concerned with Kerberos Authentication Procedures:

SP - Source Personnel

DP - Destination Personnel

GWKS - Gateway Kerberos Server

SP�GWKS : Options||IDSP||RealmSP||IDGWKS||Times||Nonce1 (7.5)

GWKS�SP : RealmSP||IDSP||TicketDP||E(KSP,GWKS,[KSP,DP||Times||Nonce1||

RealmDP||IDDP])||E(KSP[KSP,GWKS]) (7.6)

TicketDP=E(KDP[Flags||KSP,DP||RealmSP||IDSP||ADSP||Times])

a. Exchanges between SP and GWKS to obtain Ticket DP

SP�DP : Options|| TicketDP||AuthenticatorSP (7.7)

AuthenticatorSP=E(KSP,DP,[IDSP||RealmSP||TS1])

DP�SP : E(KSP,DP[TS2|| Subkey|| seq#]) (7.8)

b. SP/DP Authentication Exchange to obtain service

Equation (7.5) indicates a request from the source personnel to gateway

Kerberos server in order to receive valid ticket for obtaining required services from

destination personnel. This request consists of identity of source personnel, identity

of gateway Kerberos server, realm in which source personnel is present and the

timestamp of generation of the request along with options.

Equation (7.6) indicates how a ticket for source personnel to obtain

services from destination personnel is issued by gateway Kerberos server. This

message contain the actual ticket, unique key used for communication between

105

source personnel and destination personnel encrypted using the key that is known to

source personnel and gateway Kerberos server alone. The key that is known to

source personnel and gateway Kerberos server is encrypted using the key of source

personnel which is known to source personnel only. The key that is to be shared

only among the source personnel and gateway Kerberos server is generated every

time when authentication requests are received from the source personnel.

Timestamp is added at appropriate places to check the life and validity of the request

and reply.

Equation (7.7) denotes the process of requesting the service from

destination personnel by the source personnel through providing necessary

credentials such as ticket for destination personnel issued by gateway Kerberos

server, and authenticator message which contains identity of source personnel and

realm of source personnel encrypted using the key that is known to source personnel

and destination personnel alone. This key is also present in the ticket for destination

personnel who encrypted using the key of destination personnel which is known to

itself and gateway Kerberos server. Equation (7.8) indicates the issuance of subkey

for further communication between source personnel and destination personnel after

verification of the credentials.

7.4 ANALYSIS OF RESPONSE TIMES FOR KERBEROS

AUTHENTICATION

As discussed in the previous section, different levels of hierarchical data

centre systems need to authenticate each other in order to send messages. Also,

cluster heads need to get authenticated at the cloud gateway, so that packets from

sensor nodes can successfully reach the cloud gateway. Cloud gateway is denoted as

Kerberos Distribution Centre (KDC) which is implemented in the cloud gateway in

Figure 7.6 for the sake of clarity in understanding. KDC consists of Authentication

Server (AS) and Ticket Granting Server (TGS). Since in our structure we have

conceptualized the Kerberos distribution centre as a single system which performs

the functions of both AS and TGS in a combined fashion and we call it as Kerberos

Server (KS). Though there are different distributions of Kerberos available, we

106

preferred the Heimdal Kerberos server due to its multithreading support. Heimdal

distribution implements Kerberos v5 authentication services [98]. Kerberos service

implementation in the cloud gateway made use of a symmetric key cryptographic

algorithm known as Advanced Encryption Standard (AES). AES has a block size of

128 bit and it supports 128, 192, 256 bit keys. AES is also resistant to timing based

cryptanalysis. If a new principal in Kerberos database has to be added or if a

principal’s key has to be changed, it is done using a protocol between a client and a

third Kerberos server known as Kerberos Administration Server (KADM). This

protocol is not discussed in this work.

Performance of Kerberos authentication protocol using AES is carried

out in CloudAnalyst [100]. CloudAnalyst is based on CloudSim and is built on the

multithreading capabilities of Java. CloudAnalyst supports creation of systems

within data centers. These systems were created and configured as Virtual Machines

(VMs) within the CloudAnalyst- Cloud Computing Simluator.

Figure 7.6 shows a typical setup of a Kerberos distribution centre for

mutual authentication. Kerberos server (KS) is created as a separate virtual machine

with Ubuntu server. Two virtual machines in two different data centers were created

to use Ubuntu distribution of Client Operating Systems. Since, in our proposed

defense structure, there is no separate application server physically available, we

consider using one VM configured with Ubuntu client OS, as client and another VM

configured with Ubuntu Client OS as application server. Heimdal distribution of

Kerberos v5 contained a component to be installed in the client machines. It is

configured to issue requests periodically, quickly confirm the validity of the

response and timestamp the transaction to report response time statistics. Since KS

and data center systems are present within a private defense cloud, it is logical to

consider it as a single realm of Kerberos authentication protocol. Bandwidth of

internal network used for communication among systems in cloud is set to 10 Gbps.

107

Figure 7.6 Kerberos Distribution Centre for Mutual Authentication

Since it can be equally argued that systems present in the cloud should be

assumed to be present in different realms, CloudAnalyst configurations of VMs for

different systems of Kerberos were executed. The executions were carried out for

local authentication as well as cross realm authentication. Client systems were

configured to issue 10 to 15 requests per minute. Kerberos distribution component

installed in client is also configured to timestamp the transaction that ultimately

authenticates it to the application servers. Based on this timestamp, client can record

the response time statistics for different number of requests.

We utilized CloudAnalyst, a simulator for cloud computing to create

virtual machines within two data centers with Ubuntu distribution of Linux. These

client systems are configured to issue 10 to 15 requests per minute. Kerberos

distribution component in client, timestamps the transaction that ultimately

authenticates it to the application servers. Heimdal Kerberos server distribution is

108

used in the cloud gateway system created in the CloudAnalyst to implement

Kerberos Distribution Center (KDC).

We simulated the modified form of Kerberos to perform Node level

authentication and User level authentication, where only one Kerberos Server is

present instead of Authentication Server (AS) and Ticket Granting Server (TGS).

We have also compared the performance in terms of response time of the

authentication mechanism using normal Kerberos and modified Kerberos protocols.

The graphs (Figure 7.7 and Figure 7.8) provide results for response time

based on single realm node level authentication and cross-realm node level

authentication respectively with respect to normal Kerberos protocol and our

modified Kerberos protocol to suit the proposed defense structure.

The graphs in Figure 7.9 and Figure 7.10 depict the performance of

normal Kerberos protocol with our modified Kerberos protocol in terms of response

times for User level authentication in single realm and cross realm configurations.

Figure 7.7 Response Times for Node Level Authentication with Single Realm

109

Figure 7.8 Response Times for Node Level Authentication with Cross Realm

using one hop server

Figure 7.9 Response Times for User Level Authentication with Single Realm

110

Figure 7.10 Response Times for User Level Authentication with Cross Realm

using one hop server

7.5 CONCLUSION

In this chapter we discuss the importance of secure communications in a

tactical environment like military. It also presents the various technologies and

protocols developed for the purposes of enhancing security of defense users and

systems. The need for rigid authentication is well asserted through the discussions in

the chapter based on string authentication mechanism in the form of Kerberos

authentication protocol. We also modified the Kerberos authentication protocol to

suit our proposed defense structure and the necessary equations were provided.

Response time is a critical parameter in the improvement of Quality of Service

(QoS) as part of military security technology. The performance of the altered

Kerberos protocol was tested using simulations in CloudAnalyst with Heimdal

Distribution of Kerberos with AES library for User level authentication with the

help of response times. For node level authentication, response times were recorded

based on NS-2 simulator’s packet data provided to CloudAnalyst and Heimdal

distribution.

111

CONCLUSION AND FUTURE WORK

It has become imperative that in present day military operations,

timeliness and integrity of information and data transmission are very critical.

Ammunitions and hardware requirements are already available in a highly

sophisticated manner. But what is lacking is, deployment and analysis of modern

methodologies in terms of logistics that involve hybrid algorithms towards security

and reliable transmission of information and data. In this respect, the thesis covers

time synchronization for real time effects, scheduling and transmission of data using

queuing models and authentication requirements with Kerberos. The algorithms

suggested are supported by appropriate simulation.

In this respect, this thesis conceived a proposal to use private cloud

structure for typical military applications where WSNs are deployed and simulation

of clustering process based on LEACH algorithm is carried out .This dissertation

also covers time synchronization for real time effects, among nodes of wireless

sensor networks. Slave controlled time synchronization for high density wireless

sensor networks with large number of clusters is developed as part of this

dissertation and the results show relatively reduced relative clock drift among sensor

nodes compared to the widely used TPSN mechanism. Since it is necessary to have

a consistent snapshot of data present within the nodes, this thesis have discussed

data synchronization as part of the WSNs based on slave controlled time

synchronization scheme. This dissertation have employed M/G/1 queuing model to

service data packets at the cloud gateway which lies at the heart of the structure

proposed. The use of queuing model in the structure is carried out only to

streamline the scheduling and transmission of data to various military entities

present off the battlefield. Since authentication is very vital in the proposed military

cloud structure for communication and transactions among various entities,