Transcript What is network security?

Chapter 8
Security
1
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Securing wireless LANs
Operational security: firewalls and IDS
2
What is network security?
confidentiality: only sender, intended receiver should
“understand” message contents
 sender encrypts message
 receiver decrypts message
authentication: sender, receiver want to confirm identity of
each other
message integrity: sender, receiver want to ensure message
not altered (in transit, or afterwards) without detection
access and availability: services must be accessible and
available to users
3
Friends and enemies: Alice, Bob, Trudy



well-known in network security world
Bob, Alice want to communicate “securely”
Trudy (intruder) may intercept, delete, add messages
Alice
Bob
channel
data
secure
sender
data, control
messages
secure
s
receiver
data
Trudy
4
Who might Bob, Alice be?






… well, real-life Bobs and Alices!
Web browser/server for electronic transactions
(e.g., on-line purchases)
on-line banking client/server
DNS servers
routers exchanging routing table updates
other examples?
5
There are bad guys (and girls) out there!
Q: What can a “bad guy” do?
A: eavesdrop: intercept messages (sniffing and
recording)
 actively insert messages into connection
(modification, deletion)
 impersonation: can fake (spoof) source address in
packet (or any field in packet)
 hijacking: “take over” ongoing connection by
removing sender or receiver, inserting himself in
place
 denial of service: prevent service from being used by
others (e.g., by overloading resources)
6
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Securing wireless LANs
Operational security: firewalls and IDS
7
The language of cryptography
Alice’s
K encryption
A
key
plaintext
encryption
algorithm
Bob’s
K Bdecryption
key
ciphertext
decryption plaintext
algorithm
m plaintext message
KA(m) ciphertext, encrypted with key KA
m = KB(KA(m))
In symmetric key systems, Alice’s
and Bob’s keys are identical and are
secret. In public key systems, a
pair (public )of keys is used.
8
Public Key Cryptography
symmetric key crypto


requires sender, receiver
know shared secret key
Q: how to agree on key in
first place (particularly if
never “met”)?
public key crypto





radically different approach
[Diffie-Hellman76, RSA78]
“Diffie-Hellman Key Exchange
Algorithm”
sender, receiver do not share
secret key
public encryption key known
to all
private decryption key known
only to receiver
Used also for authentication
and digital signatures
9
Public key cryptography
+ Bob’s public
B key
K
K - Bob’s private
B key
plaintext
message, m
encryption
algorithm
ciphertext
K +(m)
B
decryption
algorithm
plaintext
message
+
m = KB (K (m))
B
10
Public key encryption algorithms
requirements:
.
.
+ ( ) and K - ( ) such that
need
K
1
B
-
+
B
B
B
K (K (m)) = m
2 given public key K +B, it should be
impossible to compute private
key K
B
RSA:Rivest, Shamir,Adelson algorithm
11
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Securing wireless LANs
Operational security: firewalls and IDS
12
Digital signatures
cryptographic technique analogous to hand-written
signatures:


sender (Bob) digitally signs document, establishing
he is document owner/creator.
verifiable, nonforgeable: recipient (Alice) can prove to
someone that Bob, and no one else (including Alice),
must have signed document
13
Digital signatures
simple digital signature for message m:

-
Bob signs m by encrypting with his private key KB,
creating “signed” message, KB(m)
Bob’s message, m
Dear Alice
Oh, how I have missed
you. I think of you all the
time! …(blah blah blah)
Bob
-
K B Bob’s private
key
Public key
encryption
algorithm
-
m,K B(m)
Bob’s message,
m, signed
(encrypted) with
his private key
14
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Securing wireless LANs
Operational security: firewalls and IDS
15
End-point authentication
 is the process of one entity proving its identity to another
entity over a computer network
 This is a different problem from proving that a message
received at some point in the past did indeed come from
that claimed sender
 it is often network elements such as routers and
client/server processes that must authenticate each other
16
Authentication
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap1.0: Alice says “I amAlice”
“I am Alice”
Failure scenario??
17
Authentication
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap1.0: Alice says “I amAlice”
“I am Alice”
in a network,
Bob can not “see” Alice,
so Trudy simply declares
herself to be Alice
18
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Securing wireless LANs
Operational security: firewalls and IDS
19
Secure e-mail

Security in
application
transport
network
e-mail (PGP)
SSL,TLS
IPsec
link
IEEE 802.11 wireless LAN protocol
20
Secure e-mail
 Alice
wants to send confidential e-mail,m,to Bob.
KS
m
K ( .)
S
+
KS
KS(m )
KS(m )
+
.
KB ( )
K+
B
+
KB(KS )
.
KS( )
-
Internet
+
KB(KS )
m
KS
-
.
KB ( )
K-B
Alice:
 generates random symmetric private key,KS
 encrypts message with KS (for efficiency)
 also encrypts KS with Bob’s public key
 sends both KS(m) and KB(KS) to Bob (“+” represents concatenation)
21
Secure e-mail
 Alice
wants to send confidential e-mail,m,to Bob.
KS
m
.
KS( )
+
KS
+
.
KB ( )
K+
B
KS(m )
KS(m )
+
KB(KS )
.
KS( )
-
Internet
+
KB(KS )
m
KS
-
.
KB ( )
K-B
Bob:
 uses his private key to decrypt and recover KS
 uses KS to decrypt KS(m) to recover m (“–” deconcatenation)
public key encryption is relatively inefficient, particularly for long messages
22
Secure e-mail (continued)

Alice wants to provide sender authentication & message integrity
K+
A
KA-
.
H( )
m
.
K- ( )
A
+
m


-
-
KA(H(m))
KA(H(m))
Internet
-
+
.
KA ( )
compare
.
H( )
m
H(m )
H(m )
Alice applies a hash function,H (for example,MD5) to m,to
obtain a message digest, and signs the result of the hash
function with her private key
sends both message (in the clear) and digital signature
23
Secure e-mail (continued)
 Alice
wants to provide secrecy, sender authentication,
message integrity.
-
KA
m
.
H( )
.
K- ( )
A
Trudy masquerade
as Bob?
-
KA(H(m))
+
KS
.
KS( )
+
m
KS
+
.
KB ( )
K+
B
Internet
+
KB(KS )
Alice uses three keys:her private key,Bob’s public key,newly
created symmetric key (2 public crypto & 1 symmetric)
24
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Securing wireless LANs
Operational security: firewalls and IDS
25
SSL: Secure Sockets Layer
 widely
deployed security
protocol
 original
goals:
 Web e-commerce
 supported by almost all
transactions
browsers, web servers
 encryption (especially
 https
credit-card numbers)
 billions $/year over SSL
 Web-server authentication
 implementation: Netscape
 optional client
authentication
 variation -TLS: transport layer
security, RFC 2246
 minimum hassle in doing
business with new
 provides
merchant
 confidentiality
 available to allTCP
 integrity
applications
 authentication
 secure socket interface
26
SSL and TCP/IP
Application
Application
SSL
TCP
IP
normal application


TCP
IP
application with SSL
SSL provides application programming interface
(API) to applications
C and Java SSL libraries/classes readily available
27
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Securing wireless LANs
Operational security: firewalls and IDS
28
Virtual Private Networks (VPNs)
motivation:
institutions (extended over multiple geographical
regions) often want private networks for security.
 costly: separate routers, links, DNS infrastructure.
VPN: institution’s
inter-office traffic is sent over
public Internet instead
 encrypted before entering public Internet
 logically separate from other traffic
29
Virtual Private Networks (VPNs)
laptop
w/ IPsec
public
Internet
salesperson
in hotel
router w/
IPv4 and IPsec
router w/
IPv4 and IPsec
branch office
headquarters
30
IPsec services





data integrity
origin authentication
replay attack prevention
confidentiality
In the IPsec protocol suite, there are two
principal protocols providing different service
models:
 the Authentication Header (AH) protocol
 the Encapsulation Security Payload (ESP) protocol
31
Chapter 8: roadmap
1.
2.
3.
4.
5.
6.
7.
8.
What is network security?
Principles of cryptography
Message Integrity and Digital Signatures
End-Point Authentication
Securing e-mail
Securing TCP connections: SSL
Network layer security: IPsec
Operational security: firewalls and IDS
32
Firewalls, IDS, IPS
firewall
combination of hardware and software that isolates
organization’s internal net from larger Internet, allowing some
packets to pass, blocking others
single point of entry/exit
public
Internet
administered
network
trusted “good guys”
firewall
untrusted “bad guys”
33
Firewalls
A firewall has three goals:
1. All traffic from outside to inside,and vice versa,passes
through the firewall
2. Only authorized traffic, as defined by the local security policy,
will be allowed to Pass
3. The firewall itself is immune to penetration
public domain software
34
Firewalls: why
prevent denial of service attacks:
 SYN flooding: attacker establishes many bogus TCP
connections, no resources left for “real” connections
prevent illegal modification/access of internal data
 e.g., attacker replaces CIA’s homepage with something else
allow only authorized access to inside network
 set of authenticated users/hosts
three types of firewalls:
 stateless packet filters
 stateful packet filters
 application gateways
35
Intrusion detection systems
IDS: A device that generates alerts when it observes
potentially malicious traffic
36
Intrusion detection systems

multiple IDSs: different types of checking at different
locations; distributed to lower amount of processing from
central IDS; one is used with high performance firewalls
high security region
firewall
internal
network
IDS
sensors
Internet
Web
DNS
server FTP server
server
lower security region
demilitarized
Zone (DMZ)
37
Network Security (summary)
basic techniques…...
 cryptography (symmetric and public)
 message integrity
 end-point authentication
…. used in many different security scenarios
 secure email
 secure transport (SSL)
 IP sec
 operational security: firewalls and IDS
38