INTERNET FIREWALLS FOR TRUSTED SYSTEM

A firewall is a system placed between a trusted internal network and an untrusted external
network (Internet) to establish a controlled communication link. It forms a security
perimeter and acts as a single choke point where all traffic is monitored and controlled.

Functions of Firewall

• Prevents unauthorized users from accessing the network

• Blocks vulnerable services

• Protects against IP spoofing and routing attacks

• Provides monitoring and logging of network activity

• Supports NAT and VPN (IPSec)

• Ensures all traffic passes through a single controlled point

2.1 ROLES OF FIREWALLS

Firewalls enforce the organization’s security policy using the following techniques:

1. Service Control

• Determines which Internet services are allowed (HTTP, FTP, SMTP)

• Can filter traffic using port numbers and protocols

2. Direction Control

• Controls the direction of data flow (inbound/outbound)

• Example: Allow outgoing HTTP but block incoming requests

3. User Control

• Provides access based on user identity

• Example: Only authorized users can access certain services

4. Behavior Control

• Controls how services are used

• Example: Filtering email content or restricting downloads

2.2 TYPES OF FIREWALLS

1. Packet-Filtering Router

• Applies rules to each incoming and outgoing packet

• Filters based on:

o Source/Destination IP address

o Port numbers

o Protocol

Features

• Uses rule-based filtering

• Default policies:

o Deny all (secure)

o Allow all (less secure)

Advantages

• Simple and fast

• Transparent to users

Limitations

• Cannot detect application-level attacks

• Vulnerable to spoofing and fragmentation attacks

2. Stateful Packet Filters

• Maintains a state table of active connections

• Allows packets only if they belong to a valid session

Advantages

• More secure than packet filters

• Detects abnormal or unexpected packets

3. Application-Level Gateway (Proxy Firewall)

• Operates at the application layer

• Acts as an intermediary between client and server

Working

• User connects to gateway

• Gateway authenticates user

• Gateway forwards request to external server

Advantages

• High security

• Detailed logging and auditing

Disadvantages

• Slower due to processing overhead

• Limited application support

4. Circuit-Level Gateway

• Operates at session layer

• Establishes TCP connections between internal and external hosts

Features

• Does not inspect packet content

• Only checks validity of connection

Advantages

• Faster than proxy

• Hides internal network structure

Disadvantages

• No content filtering

• Lower security

5. Bastion Host

• A highly secured system exposed to external network

• Acts as a platform for firewall services

Characteristics
 • Secure operating system

• Only essential services installed

• Strong authentication

• Maintains detailed logs

• Runs minimal and independent proxy modules

2.3 FIREWALL DESIGN

Different firewall configurations provide different levels of security:

1. Screened Host Firewall (Single-Homed Bastion)

• Uses:

o Packet-filtering router

o Bastion host

• Provides two layers of protection

2. Screened Host Firewall (Dual-Homed Bastion)

• Physically separates internal and external networks

• Requires two systems to be compromised

• More secure than single-homed configuration

3. Screened Subnet Firewall (DMZ)

• Most secure configuration

• Uses:

o Two packet-filtering routers

o Isolated subnet (DMZ)

Advantages

• Three levels of defense

• Internal network is hidden

• Controlled access between networks

3.4 FIREWALLS DESIGN PRINCIPLES

A firewall must satisfy the following principles:

1. All traffic must pass through the firewall

o No direct access to internal network

2. Only authorized traffic is allowed

o Based on defined security policies

3. Firewall must be secure (trusted system)

o Resistant to penetration

o Uses secure operating system

Capabilities of Firewall

• Acts as a single choke point

• Monitors and logs traffic

• Provides platform for VPN and NAT

• Enforces security policies

Limitations of Firewall

• Cannot prevent attacks that bypass it

• Cannot stop internal threats

• Cannot fully protect against viruses

Conclusion

Firewalls play a crucial role in establishing a security framework by controlling access,

monitoring traffic, and enforcing security policies. However, they are not a complete solution
and must be combined with other mechanisms like intrusion detection systems and antivirus
tools for comprehensive security.
Intrusion Detection System (IDS)

An Intrusion Detection System (IDS) is a security mechanism used to detect unauthorized

access or attacks on a system. It acts as a second line of defense when prevention
mechanisms fail.

Need for IDS

• Detect intrusions before damage occurs

• Identify intruders and remove them from the system

• Acts as a deterrent to attackers

• Helps collect information about intrusion techniques

Basic Concept

IDS is based on the assumption that the behavior of an intruder differs from that of a
legitimate user, and this difference can be analyzed and detected.

There is always a trade-off:

• Loose detection → more false positives

• Strict detection → more false negatives

Types of Intrusion Detection

1. Statistical Anomaly Detection

• Collects data of normal user behavior

• Uses statistical tests to detect abnormal behavior

Methods:

• Threshold detection → checks event frequency

• Profile-based detection → compares user behavior with stored profile

2. Rule-Based Detection

• Uses predefined rules to detect intrusions

• Matches activities with known attack patterns

Types:

• Rule-based anomaly detection

• Rule-based penetration identification

Intrusion Detection Approaches

• Anomaly detection → detects deviation from normal usage

• Penetration identification → detects known attack patterns using expert systems

Audit Records

IDS depends on audit data which includes:

• Subject → user or process

• Object → resource accessed

• Resource usage → CPU, I/O, etc.

• Timestamp → time of activity

Audit records help in analyzing system behavior and detecting intrusions.

Statistical Measures Used

• Counter (event count)

• Gauge (current value measurement)

• Interval timer (time between events)

• Resource utilization

These help in identifying abnormal activities.

Distributed Intrusion Detection

• Uses multiple systems for monitoring

• Components:

o Host agent

o LAN monitor agent

 o Central manager

Central manager analyzes data and detects intrusion patterns.

Conclusion

IDS plays a vital role in system security by detecting unauthorized activities, analyzing
behavior patterns, and helping prevent future attacks. It enhances overall security when
combined with other mechanisms like firewalls.

2.4 SET (SECURE ELECTRONIC TRANSACTION)

SET is an open encryption and security specification designed to protect credit card
transactions on the Internet. It enables secure use of existing payment infrastructure over
open networks.

Services Provided by SET

1. Provides a secure communication channel among all parties

2. Provides trust using X.509v3 digital certificates

3. Ensures privacy of transaction information

SET REQUIREMENTS

• Confidentiality of payment and ordering information

• Integrity of transmitted data

• Authentication of cardholder

• Authentication of merchant

• Use of best security practices

• Interoperability among systems

SET KEY FEATURES

• Confidentiality of information

• Integrity of data

• Cardholder account authentication

• Merchant authentication
SET PARTICIPANTS (COMPONENTS INVOLVED)

1. Cardholder – Purchases goods/services

2. Merchant – Provides goods/services

3. Issuer – Bank issuing credit card

4. Acquirer – Bank processing merchant payments

5. Payment Gateway – Processes payment messages

6. Certification Authority (CA) – Issues X.509 certificates

EVENTS IN A TRANSACTION

1. Customer obtains credit card account

2. Customer receives X.509v3 certificate

3. Merchant obtains certificate

4. Customer places order

5. Merchant sends certificate for verification

6. Order and payment information are sent

7. Merchant requests payment authorization

8. Merchant confirms order

9. Merchant delivers goods/services

10. Merchant receives payment

[Draw Diagram] → SET Transaction Flow

DUAL SIGNATURE

Purpose

• Links Order Information (OI) and Payment Information (PI)

• Ensures privacy (merchant cannot see payment details, bank cannot see order
details)

Working
 • Compute hash of PI → H(PI)

• Compute hash of OI → H(OI)

• Combine both hashes

• Compute hash again

• Encrypt using customer’s private key → Dual Signature

Verification

• Merchant verifies using OI + PIMD

• Bank verifies using PI + OIMD

• Ensures linkage between OI and PI

[Draw Diagram] → Dual Signature Process

PURCHASE REQUEST

Message Includes

• Payment Information (PI)

• Dual Signature

• Order Information Message Digest (OIMD)

• Digital envelope (encrypted key)

• Order Information (OI)

• PI Message Digest (PIMD)

• Cardholder certificate

Processing by Merchant

1. Verifies cardholder certificate

2. Verifies dual signature

3. Processes order

4. Sends payment info to payment gateway

5. Sends purchase response to customer

[Draw Diagram] → Purchase Request Flow

PURCHASE RESPONSE

• Merchant sends response block

• Includes transaction number

• Digitally signed by merchant

• Sent with merchant certificate

• Customer verifies signature and certificate

HOW SET ENABLES E-TRANSACTIONS

• Authentication → Certificates verify identities

• Confidentiality → Encryption protects data

• Integrity → Dual signature ensures data is not altered

• Privacy → Payment and order information are separated

• Secure processing → Payment gateway handles transactions

IMPORTANT DIAGRAMS TO DRAW

• SET Transaction Flow

• Dual Signature

• Purchase Request Flow

CONCLUSION

SET protocol enables secure electronic transactions by providing authentication,

confidentiality, integrity, and privacy, ensuring safe credit card usage over the Internet.