NETWORK SECURITY
Complete Study Notes
8 Units • 16 Marks Each
Topics Covered:
Digital Signatures • Firewalls • IDS & IPS • IPSec
VPN • X.509 Certificates • PGP • Network Layer Attacks
UNIT 1 Digital Signature
1.1 Introduction
A Digital Signature is a highly secure cryptographic mechanism used to validate the authenticity
and integrity of a digital message, document, or transaction. In modern communication systems
where data is transmitted over insecure networks such as the internet, it is essential to ensure that: (i)
the message has not been altered during transmission, and (ii) it originates from a legitimate sender.
Digital signatures provide a reliable solution using public-key cryptography.
1.2 Why Are Digital Signatures Needed?
Traditional handwritten signatures are not feasible in electronic communication. Digital signatures
address the following critical requirements:
• Authentication: Verifying the identity of the sender with certainty.
• Integrity: Ensuring the message has not been modified during transit.
• Non-Repudiation: Preventing the sender from falsely denying having sent the message.
1.3 Working Principle
1.3.1 Signature Generation
The sender first prepares the message and applies a hash function (e.g., SHA-256) to produce a
fixed-length message digest. This digest uniquely represents the original message. The digest is
then encrypted with the sender's private key, producing the digital signature. Finally, the original
message and the signature are transmitted together.
1.3.2 Signature Verification
Upon receiving the message, the receiver: (1) decrypts the digital signature using the sender's public
key to recover the original hash, and (2) independently applies the same hash function to the
received message. If both hash values match, the message is authentic and unaltered. A mismatch
signals tampering or forgery.
1.4 ElGamal Digital Signature Algorithm
Key Generation
Select a large prime p and a generator g. Choose a private key x at random. Compute the public key:
y = gx mod p
The public key (p, g, y) is shared openly; x remains secret.
Signature Generation
Choose a random integer k coprime to (p-1). Compute:
r = gk mod p
s = k-1 (H(m) - xr) mod (p-1)
The pair (r, s) constitutes the digital signature on message m.
Signature Verification
The verifier checks the following equation:
gH(m) mod p = yr . rs mod p
If the equation holds, the signature is valid; otherwise it is rejected.
1.5 Applications & Advantages
• Secure email systems (S/MIME, PGP).
• Online banking and financial transactions.
• Software code signing and distribution.
• Blockchain and cryptocurrency systems.
• Legal e-documents and e-governance.
Conclusion: Digital signatures are an indispensable element of modern cryptographic infrastructure,
enabling secure, reliable, and legally recognised communication over insecure networks.
UNIT 2 Firewall
2.1 Introduction
A Firewall is a critical network security device or software that acts as a protective barrier between a
trusted internal network and an untrusted external network (such as the internet). It monitors,
filters, and controls both incoming and outgoing traffic based on predefined security rules, thereby
preventing unauthorised access and cyber threats.
2.2 Core Functions of a Firewall
• Traffic Filtering: Allows only legitimate packets; blocks unauthorised ones.
• Policy Enforcement: Applies organisational security rules uniformly.
• Logging & Monitoring: Maintains logs for forensic analysis and alerts.
• NAT (Network Address Translation): Hides internal IP addresses from external view.
• VPN Support: Facilitates encrypted tunnels for remote access.
2.3 Types of Firewalls
2.3.1 Packet Filtering Firewall
Operates at the Network Layer (Layer 3). Examines each packet individually based on
source/destination IP address, port numbers, and protocol type. It is fast and lightweight but provides
no stateful context – each packet is evaluated in isolation.
2.3.2 Stateful Inspection Firewall
Maintains a state table tracking active connections. Decisions are made based on packet context
(new, established, or related connections). Far more secure than simple packet filtering; can detect
connection-hijacking and fragmentation attacks.
2.3.3 Application Layer Firewall (Proxy Firewall)
Works at Layer 7 (Application Layer). Deep-inspects the actual payload of traffic (HTTP, FTP,
DNS). Can block malicious content, application-level exploits, and data leakage.
2.3.4 Next-Generation Firewall (NGFW)
Combines stateful inspection with application awareness, intrusion prevention (IPS), SSL inspection,
and identity-based policies. NGFWs represent the current industry standard.
2.4 Firewall Architectures
Architecture Description Use Case
Single machine with two NICs –
Dual-Homed Host one internal, one external. All Small networks
traffic passes through it.
Packet-filtering router + bastion
Screened Host host combination. Router filters; Medium enterprises
bastion applies application rules.
Creates a neutral Demilitarized
Zone (DMZ) for public-facing
Screened Subnet (DMZ) Large organisations
servers (web, mail, DNS).
Protects internal network.
2.5 Advantages & Limitations
Advantages:
• First line of defence against external cyber attacks.
• Granular traffic control based on ports, IPs, protocols.
• Audit trail through logging and alerts.
Limitations:
• Cannot prevent insider threats or socially engineered attacks.
• May not detect zero-day or encrypted malware traffic.
• Improperly configured firewalls create false security.
Conclusion: Firewalls remain a foundational security control in any network architecture, though they
must be complemented by IDS/IPS, encryption, and user education.
Intrusion Detection System (IDS) & Intrusion
UNIT 3
Prevention System (IPS)
3.1 Introduction
As network-based applications proliferate, so do sophisticated cyber threats. Intrusion Detection
Systems (IDS) and Intrusion Prevention Systems (IPS) are deployed to continuously monitor
network traffic and system behaviour, identify malicious activity, and (in the case of IPS) automatically
neutralise threats in real time.
3.2 Intrusion Detection System (IDS)
An IDS is a passive security monitoring tool that analyses network traffic or host activities against
known attack patterns and baseline behaviours. It does not block traffic but generates alerts for
security administrators to investigate.
3.2.1 Host-Based IDS (HIDS)
Installed on individual endpoints. Monitors file integrity, system logs, registry changes, and running
processes. Effective for detecting insider threats and targeted malware.
3.2.2 Network-Based IDS (NIDS)
Deployed at strategic network chokepoints (e.g., behind the gateway router). Captures and analyses
packets in real time. Suitable for detecting network-wide attacks such as port scans, DoS floods, and
protocol anomalies.
3.3 Detection Techniques
3.3.1 Signature-Based Detection
Compares traffic against a database of known attack signatures (patterns). Highly accurate for
known threats; unable to detect zero-day or novel attacks. Requires frequent signature database
updates.
3.3.2 Anomaly-Based Detection
Establishes a baseline of normal behaviour through statistical profiling. Deviations from this baseline
trigger alerts. Capable of detecting unknown attacks but prone to false positives in dynamic
environments.
3.3.3 Heuristic / Behaviour-Based Detection
Uses rules derived from expert knowledge and ML models to identify suspicious behaviour patterns.
Bridges the gap between signature-based and anomaly-based approaches.
3.4 Intrusion Prevention System (IPS)
An IPS is an active, inline security control that not only detects attacks but also takes immediate
automated action: dropping malicious packets, terminating TCP sessions, reconfiguring firewall rules,
or quarantining infected hosts. It operates transparently in the data path with near-zero latency
impact.
3.5 IDS vs IPS – Comparison
IDS IPS
Passive monitoring only Active inline prevention
Generates alerts for human review Automatically blocks/drops traffic
No direct network impact Sits in the data path; slight latency risk
Best for visibility and forensics Best for real-time threat containment
Lower risk of false-block disruption Misconfiguration may block legitimate traffic
Conclusion: IDS and IPS are complementary technologies. Deploying both in a layered security
architecture provides maximum visibility and automated protection against evolving threats.
UNIT 4 IP Security (IPSec)
4.1 Introduction
IP Security (IPSec) is an IETF-standardised suite of protocols designed to provide end-to-end
security for communications over IP networks. Because the standard IP protocol offers no built-in
security, IPSec was developed to add confidentiality, data integrity, authentication, and
anti-replay protection at the network layer – transparently to upper-layer applications.
4.2 Modes of Operation
4.2.1 Transport Mode
Only the payload (data portion) of the IP packet is protected; the original IP header remains intact.
Used for direct, end-to-end communication between two hosts, typically in corporate LANs or
host-to-host VPNs. Efficient in terms of overhead.
4.2.2 Tunnel Mode
The entire original IP packet (header + payload) is encapsulated inside a new IP packet with a new
header. This hides the original source and destination addresses. Predominantly used in site-to-site
VPNs and gateway-to-gateway configurations.
4.3 IPSec Protocols
4.3.1 Authentication Header (AH)
AH provides data integrity and source authentication by computing an HMAC over the packet
contents. It does not encrypt the payload, so data confidentiality is not provided. Useful where
encryption is legally restricted.
4.3.2 Encapsulating Security Payload (ESP)
ESP provides confidentiality (via symmetric encryption: AES, 3DES), integrity, and optional
authentication. It encrypts the payload and optionally the ESP header. ESP in tunnel mode is the
most common IPSec configuration used in VPNs today.
4.4 Security Services Summary
Security Service AH ESP (without auth) ESP (with auth)
Confidentiality
No Yes Yes
(Encryption)
Data Integrity Yes Yes Yes
Source Authentication Yes No Yes
Anti-Replay Protection Yes Yes Yes
Traffic Flow
No Partial (tunnel) Partial (tunnel)
Confidentiality
4.5 Key Management – IKE
Internet Key Exchange (IKE) automates the negotiation and exchange of cryptographic keys and
security parameters (Security Associations, SAs). IKE operates in two phases: Phase 1 establishes a
secure channel; Phase 2 negotiates the actual IPSec SA.
Conclusion: IPSec is a versatile, protocol-agnostic security framework that forms the backbone of
VPN technology and secure enterprise networking.
UNIT 5 Virtual Private Network (VPN)
5.1 Introduction
A Virtual Private Network (VPN) creates a secure, encrypted tunnel over a public network (such as
the internet), enabling private communication as if users were on a dedicated private network. VPNs
protect data confidentiality, ensure integrity, and authenticate users, making them indispensable for
remote workers, multi-site enterprises, and privacy-conscious individuals.
5.2 How a VPN Works
When a user initiates a VPN connection: (1) a tunnelling protocol encapsulates the data packet; (2)
the encapsulated packet is encrypted before leaving the device; (3) it travels over the public internet
to the VPN gateway; (4) the gateway decrypts and decapsulates the packet and forwards it to the
destination; (5) the reverse process secures the return path.
5.3 Types of VPN
5.3.1 Remote Access VPN
Connects individual users to a central private network from any location. Widely used for remote
employees accessing corporate resources. Client software on the user's device establishes the
tunnel.
5.3.2 Site-to-Site VPN
Connects entire office networks to each other over the internet, making geographically dispersed
sites appear on the same LAN. No per-user client software needed – the VPN gateway handles it.
5.3.3 Cloud VPN / SSL VPN
Uses TLS/SSL for browser-based, clientless access. Ideal for contractors needing limited access to
specific web applications without full network access.
5.4 VPN Protocols Comparison
Protocol Layer Encryption Key Feature
Simple; legacy;
PPTP Layer 2 MPPE (RC4)
insecure – avoid
Strong security; double
L2TP/IPSec Layer 2 AES via IPSec
encapsulation
Fast reconnect;
IPSec (IKEv2) Layer 3 AES-256
mobile-friendly
Open-source; highly
OpenVPN Layer 3 AES-256-GCM
configurable
Modern; very fast;
WireGuard Layer 3 ChaCha20
minimal codebase
Browser-based; no
SSL/TLS VPN Layer 7 TLS 1.3
client required
5.5 Advantages & Limitations
Advantages:
• Encrypts data in transit, preventing eavesdropping.
• Hides the user's real IP address, enhancing anonymity.
• Enables secure remote access to corporate networks.
• Bypasses geo-restrictions and censorship.
Limitations:
• VPN servers can become bottlenecks (latency increase).
• Does not protect against endpoint compromise.
• Quality of encryption depends on the chosen protocol.
Conclusion: VPN technology is a cornerstone of secure remote connectivity, providing cost-effective
private communications over the public internet.
UNIT 6 X.509 Certificate
6.1 Introduction
The X.509 standard (ITU-T) defines the format and semantics of public-key certificates used within
a Public Key Infrastructure (PKI). An X.509 certificate binds an entity's identity (individual,
organisation, server) to its public key, enabling trusted, authenticated communication in HTTPS,
email, VPNs, and code signing.
6.2 Structure of an X.509 v3 Certificate
Field Description
Version Certificate format version (v1, v2, or v3)
Serial Number Unique identifier assigned by the CA
Algorithm used to sign the certificate (e.g.,
Signature Algorithm
SHA-256 with RSA)
Distinguished Name (DN) of the Certificate
Issuer Name
Authority
Not Before and Not After dates defining the
Validity Period
certificate's lifespan
Subject Name DN of the entity the certificate is issued to
Public Key Info The subject's public key and algorithm identifier
Subject Alt Names, Key Usage, CRL Distribution
Extensions (v3)
Points, etc.
Digital Signature CA's signature over all the above fields
6.3 Public Key Infrastructure (PKI)
PKI is the framework of policies, procedures, hardware, and software that manages the lifecycle of
digital certificates. Key components include:
• Certificate Authority (CA): Trusted issuer that signs and revokes certificates.
• Registration Authority (RA): Validates identity before certificate issuance.
• Certificate Revocation List (CRL): Publishes revoked certificates.
• OCSP (Online Certificate Status Protocol): Real-time revocation checking.
6.4 How Certificate Verification Works
When a browser connects to an HTTPS server: (1) The server presents its X.509 certificate. (2) The
browser checks the CA's signature using the CA's public key (pre-installed in the OS/browser trust
store). (3) It verifies the certificate is within its validity period and has not been revoked. (4) It checks
that the domain name matches the Subject/SAN field. Only when all checks pass is a secure TLS
session established.
6.5 Applications
• HTTPS / TLS (web server certificates – DV, OV, EV types).
• S/MIME for signed and encrypted email.
• VPN client and gateway authentication.
• Code signing to verify software publisher identity.
• Smart card and hardware security module (HSM) authentication.
Conclusion: X.509 certificates are the universal currency of digital trust on the internet, underpinning
virtually every secure online interaction.
UNIT 7 Pretty Good Privacy (PGP)
7.1 Introduction
Pretty Good Privacy (PGP), created by Phil Zimmermann in 1991, is a widely adopted encryption
program providing cryptographic privacy and authentication for data communication – especially
email. PGP is notable for its hybrid encryption model, combining the speed of symmetric encryption
with the key-management benefits of asymmetric cryptography.
7.2 Key Services Provided by PGP
• Confidentiality: Message content is encrypted and readable only by the intended recipient.
• Authentication: Digital signature confirms the sender's identity.
• Integrity: Hash ensures message has not been altered in transit.
• Compression: Reduces message size, saving bandwidth and masking patterns.
• Email Compatibility: Radix-64 (Base64) encoding ensures safe transmission.
7.3 PGP – Message Transmission Process (Step-by-Step)
• Step 1 – Hash: A hash (SHA-256) is computed over the plaintext message to produce a
message digest.
• Step 2 – Sign: The digest is encrypted with the sender's private key, forming the digital
signature.
• Step 3 – Compress: The message + signature are compressed using ZIP to reduce size.
• Step 4 – Session Key: A one-time random symmetric session key (AES-128/256) is
generated.
• Step 5 – Encrypt Message: The compressed data is encrypted with the session key.
• Step 6 – Encrypt Session Key: The session key is encrypted with the recipient's public key
(RSA/ElGamal).
• Step 7 – Transmit: The encrypted message + encrypted session key are Base64-encoded and
sent.
7.4 PGP – Message Reception Process
The receiver: (1) Decrypts the session key using their private key. (2) Uses the session key to
decrypt the message. (3) Decompresses and recovers the message + signature. (4) Computes a
fresh hash of the message. (5) Decrypts the signature with the sender's public key to get the original
hash. (6) Compares both hashes – a match confirms authenticity and integrity.
7.5 Web of Trust vs PKI
Unlike X.509 which relies on centralised CAs, PGP uses a decentralised Web of Trust model: users
sign each other's public keys to vouch for their authenticity, building chains of trust without a central
authority. This makes PGP highly resilient but harder to manage at scale.
Conclusion: PGP remains a gold standard for secure email communication, offering robust
encryption and authentication through its elegant hybrid design.
UNIT 8 Network Layer Attacks
8.1 Introduction
Network layer attacks exploit vulnerabilities in Layer 3 (IP) and related protocols to disrupt
communication, intercept data, or gain unauthorised access. Understanding these attacks is
fundamental to designing effective countermeasures.
8.2 Major Attack Types
8.2.1 IP Spoofing
The attacker forges the source IP address in packet headers to impersonate a trusted host. Used to
bypass IP-based access controls, initiate reflected DDoS attacks, or hide the attacker's true identity.
Countermeasures include ingress/egress filtering (BCP38) and IPSec authentication.
8.2.2 Denial of Service (DoS) & DDoS
An attacker floods a target with excessive traffic (SYN flood, UDP flood, ICMP flood) to exhaust
resources and deny service to legitimate users. A Distributed DoS (DDoS) uses a botnet of
compromised machines for amplified impact. Defences: rate limiting, traffic scrubbing centres,
anycast diffusion, CAPTCHAs.
8.2.3 Man-in-the-Middle (MitM) Attack
The attacker secretly intercepts and potentially alters communication between two parties. Common
variants include ARP poisoning (Layer 2), BGP hijacking, and SSL stripping. Prevention: end-to-end
encryption (TLS/HTTPS), certificate pinning, MFA.
8.2.4 Packet Sniffing
Passive capture of network packets using tools like Wireshark or tcpdump to extract plaintext
credentials, session tokens, or sensitive data. Mitigated by encrypting all traffic (TLS, IPSec, SSH)
and using switched networks.
8.2.5 IP Fragmentation Attacks
Oversized or overlapping IP fragments are crafted to bypass IDS/IPS inspection rules or crash
network stacks. Examples: Teardrop attack, Ping of Death. Fixed by patching OS IP stacks and
enabling fragment reassembly in security devices.
8.2.6 Routing Protocol Attacks
Attackers inject false routing updates (via RIP, OSPF, or BGP) to redirect traffic through
adversary-controlled nodes. BGP hijacking, for instance, can misroute massive amounts of internet
traffic. Prevention: cryptographic route authentication (RPKI, MD5 BGP sessions).
8.2.7 Smurf Attack
ICMP echo requests are sent to a broadcast address with the victim's IP spoofed as the source. All
hosts on the network reply to the victim, amplifying the DoS effect. Mitigated by disabling directed
broadcasts on routers.
8.3 Comprehensive Defence Strategies
Control Description
Filter traffic based on IP, port, protocol at network
Firewalls & ACLs
perimeter
Detect and block known attack signatures and
IDS / IPS
anomalous patterns
Encryption (IPSec/TLS) Prevent sniffing and MitM by encrypting all traffic
Block spoofed source IP addresses at network
Ingress/Egress Filtering
edges (BCP38)
RPKI / BGP Security Cryptographically validate routing announcements
Rate Limiting & DDoS Mitigation Traffic scrubbing, CDN-based protection, anycast
Keep OS and network stacks updated to eliminate
Patch Management
fragmentation bugs
Conclusion: Network layer attacks exploit fundamental weaknesses in the IP protocol suite. A
multi-layered defence strategy combining encryption, filtering, intrusion detection, and routing security
is essential to protect modern network infrastructure.