Revision notes for AQA A Level Computer Science The Internet. Open each subtopic for explanations, worked examples, and summaries of The Internet. Written against the AQA A Level Computer Science specification, so the content matches what's examinable rather than general Computer Science background.
The Internet
What you'll learn
- How the Internet is structured as a “network of networks”.
- How packets, routers, gateways, URLs, domain names and DNS work together.
- How firewalls, encryption, certificates and signatures protect communication.
- How worms, trojans and viruses spread, and how systems can be defended.
4.9.3.1 The Internet and how it works
The structure of the Internet
The Internet is not one single network owned by one organisation. It is a huge collection of connected networks: home networks, school networks, company networks, mobile networks, Internet Service Provider networks, data-centre networks and many more.
Definition
Internet
The Internet is a global public internetwork: many separate networks connected together so that devices can exchange data using agreed communication rules called protocols.
Your device usually connects first to a local network. To reach a device outside that network, your data is passed to a router, often called the default gateway on a home or school network.
Definition
Router and gateway
- A router is a device that forwards packets between networks, choosing the next part of the route using addressing information.
- A gateway connects one network to another. In many IP networks, the default gateway is the router used to reach destinations outside the local network.
The diagram shows a web request leaving a home LAN, being split into packets, routed across the Internet, and reassembled by the destination web server.
Common Mistake
Internet is not the Web
The World Wide Web is a service that runs on the Internet using web protocols such as HTTP and HTTPS. The Internet also carries email, file transfer, online games, video calls and many other services.
Packet switching
The Internet uses packet switching. Instead of reserving one continuous circuit between sender and receiver, a message is split into small chunks called packets.
Each packet can be forwarded independently. Different packets from the same message may take different routes and may arrive out of order. The receiving system uses information in the packets to put the data back together.
Definition
Main components of a packet
A packet usually contains:
- A header: control information such as source address, destination address, sequence number, protocol information and sometimes a time-to-live value.
- A payload: the actual data being carried.
- Error-checking information, such as a checksum, used to detect whether the packet has been corrupted in transit.
Packet switching is efficient because many users can share the same network links. If one route becomes congested or fails, routers may be able to send later packets by another route.
Key Idea
Packet switching
The Internet does not send a whole message as one object. It splits data into packets, forwards each packet independently, and reassembles the message at the destination.
Routing across the Internet
Routing is the process of choosing where to send a packet next. Routers do not usually know the whole end-to-end journey in detail. Instead, each router makes a local decision: “for this destination address range, which next router should I forward to?”
Routers store this information in routing tables. A routing table contains destination networks or address ranges and the next hop to use for each one.
Routing across the Internet is dynamic. Routers exchange information about reachable networks, so if a link fails or a better path becomes available, traffic can be redirected.
Example
Routing a web request
Suppose your laptop requests https://www.example.com/index.html.
-
The laptop needs the destination IP address for
www.example.com, so it asks a DNS resolver to translate the domain name into an IP address. -
The laptop creates packets for the request. Each packet includes the destination IP address of the web server and enough information for the data to be reassembled later.
-
The laptop sees that the destination is not on the local network, so it sends the packets to its default gateway, usually the local router.
-
Each Internet router reads the destination IP address, looks up the best matching route in its routing table, and forwards the packet to the next hop.
-
The packets reach the destination network. The web server receives them, reorders them if necessary, checks for errors, and processes the request.
URLs, FQDNs, domain names and IP addresses
A Uniform Resource Locator (URL) is the full address of a resource on a network, most commonly a web resource.
For example:
https://www.example.co.uk:443/revision/index.html?topic=internet
This URL contains:
https— the scheme or protocol to use.www.example.co.uk— the host name, written as a domain name.443— an optional port number./revision/index.html— the path to the resource.?topic=internet— optional query data sent to the server.
Definition
FQDN, domain name and IP address
- A fully qualified domain name (FQDN) is the complete domain name for a specific host, such as
www.example.co.uk. - A domain name is a human-readable name used to identify an Internet domain, such as
example.co.uk. - An IP address is a numerical address used by the Internet Protocol to identify a device or interface on a network.
Computers route packets using IP addresses, not friendly names. Domain names exist because www.example.co.uk is much easier for humans to remember than a numerical IP address.
How domain names are organised
Domain names are hierarchical and read from right to left.
In www.example.co.uk:
ukis the top-level domain.co.ukis a second-level structure commonly used for UK commercial organisations.example.co.ukis the registered domain.wwwis a host or subdomain within that domain.
At the top is the DNS root, often shown as a final dot in a fully written FQDN, for example www.example.co.uk.. In normal use, the final dot is usually omitted.
DNS: the domain name service
The Domain Name System (DNS) is a distributed naming system that maps domain names to IP addresses. It relies on many Domain Name Servers, not one central computer.
When you enter a URL, your computer may ask a DNS resolver for the IP address. If the resolver does not already have the answer cached, it can work through the DNS hierarchy: root servers, top-level domain servers, and authoritative name servers for the domain.
Key Idea
DNS
DNS provides the domain name service: it translates human-readable domain names into IP addresses so that packets can be routed to the correct destination.
Internet registries
Internet registries are needed to keep Internet naming and addressing coordinated. Public IP addresses and domain names must be unique, otherwise traffic could be sent to the wrong destination.
Registries allocate and manage Internet resources. For example:
- Regional Internet Registries allocate blocks of public IP addresses to organisations such as Internet Service Providers.
- Domain registries manage top-level or second-level domain spaces.
- Registrars sell or assign domain names to customers under registry rules.
Common Mistake
DNS is not the registry
DNS helps look up names that already exist. A registry is involved in allocating and recording names or address blocks so that clashes do not happen in the first place.
4.9.3.2 Internet security
Firewalls
A firewall is hardware or software that controls network traffic entering or leaving a system or network. It applies rules to decide whether traffic should be allowed, blocked, logged or redirected.
There are three firewall ideas you need to know.
Packet filtering
A packet-filtering firewall checks packet header fields, such as source IP address, destination IP address, port number and protocol. It compares these against rules.
For example, a school might block incoming traffic to most ports, but allow web traffic to a public web server.
Proxy server
A proxy server acts as an intermediary between a client and another server. The client connects to the proxy; the proxy then makes the request on the client’s behalf.
A proxy can:
- Hide internal network details.
- Log requests.
- Cache frequently used resources.
- Filter content or block banned sites.
Stateful inspection
A stateful inspection firewall tracks the state of active connections. It can allow response packets for a connection that began inside the network, while blocking unexpected incoming packets.
This is more intelligent than simple packet filtering because it considers the context of the traffic, not just each packet in isolation.
Example
Choosing firewall behaviour
A company wants staff to browse websites but does not want random external devices starting connections into office computers.
-
Outbound web requests from staff machines should be allowed because they are initiated from inside the trusted network.
-
Return packets from the websites should be allowed because stateful inspection can match them to an established outbound connection.
-
Unsolicited inbound packets should be blocked because they do not belong to an existing connection and may be probing for vulnerable services.
Symmetric and asymmetric encryption
Encryption converts readable data, called plaintext, into unreadable ciphertext using a key. Decryption converts it back.
In symmetric encryption, the same secret key is used for encryption and decryption. It is fast, so it is suitable for encrypting large amounts of data. The problem is key exchange: both parties need the same secret key, but they must not reveal it to attackers.
In asymmetric encryption, each user has a mathematically linked key pair:
- A public key, which can be shared.
- A private key, which must be kept secret.
If data is encrypted with the public key, only the matching private key can decrypt it. This helps with secure key exchange, but asymmetric encryption is slower than symmetric encryption.
The diagram shows why secure web communication usually combines both approaches: asymmetric techniques help establish trust and agree a session key, then symmetric encryption protects the bulk data efficiently.
Key Idea
Hybrid encryption
Real secure web sessions normally use asymmetric encryption to help establish a shared session key, then use fast symmetric encryption for the actual data transfer.
Digital certificates
A digital certificate is an electronic document that links an identity, such as a domain name, to a public key. It is issued and digitally signed by a trusted Certificate Authority (CA).
A website obtains a certificate by generating a key pair and requesting a certificate from a CA. The CA checks that the requester controls the domain, then signs a certificate containing information such as the domain name, public key, issuer and expiry date.
When your browser connects to a secure website, it checks that:
- The certificate is signed by a trusted CA.
- The certificate has not expired.
- The domain name matches the site you are visiting.
- The certificate has not been revoked.
If these checks pass, the browser can trust that the public key in the certificate belongs to that site.
Digital signatures
A digital signature proves authenticity and integrity. It does not, by itself, hide the message.
To create a digital signature, the sender hashes the data and encrypts the hash using their private key. The receiver uses the sender’s public key to check the signature and compares it with their own hash of the received data.
Example
Checking a digital signature
-
The receiver hashes the received message using the same hashing algorithm as the sender, producing a new message digest.
-
The receiver uses the sender’s public key to verify the digital signature and recover the signed digest.
-
The receiver compares the two digests. If they match, the message has not been altered and the signature was created using the matching private key.
Common Mistake
Signature does not mean secrecy
A digital signature helps prove who sent the data and whether it changed. Encryption is needed if the contents must be kept confidential.
Worms, trojans and viruses
Malware is malicious software designed to disrupt systems, steal data, gain control or spread to other machines.
A virus attaches itself to a host file or program. It spreads when the infected file is run or shared.
A worm is self-replicating malware that spreads across networks without needing to attach to a host program. Worms often exploit unpatched software, open network services or weak passwords.
A trojan disguises itself as legitimate software. It relies on the user installing or running it, then may create a backdoor, steal credentials or download further malware.
These malware types exploit vulnerabilities such as poor input validation, buffer overflows, insecure configuration, excessive user privileges, weak passwords, unpatched systems and social engineering.
Improving code quality, monitoring and protection
Better code quality reduces exploitable weaknesses. Developers can use secure design, input validation, bounds checking, code reviews, automated testing, static analysis and regular patching.
Monitoring helps detect attacks that still get through. This can include log analysis, intrusion detection systems, unusual network traffic alerts, anti-malware scans and file integrity checks.
Protection reduces the chance and impact of infection. Useful controls include firewalls, anti-malware software, access control, least privilege, application allow-listing, sandboxing, backups, patch management and user education.
Key Idea
Defence in depth
No single control is enough. Good security combines prevention, detection and recovery so that if one defence fails, others still reduce the damage.
Exam technique
In the exam
-
When explaining routing, mention packets, destination IP addresses, routing tables and next hops.
-
When explaining DNS, make clear that domain names are for humans, but IP addresses are used for routing.
-
When comparing encryption types, state the key difference: symmetric uses one shared key; asymmetric uses a public/private key pair.
-
For malware questions, link the malware type to how it spreads and the vulnerability or human behaviour it exploits.
Self review
Check yourself
- Why might packets from the same message take different routes across the Internet?
- What checks should a browser perform before trusting a website’s digital certificate?
- How is a worm different from a virus and a trojan?