BCSE309L

Module 7
E-mail, Web and System
Security
Winter Semester 2024-25

Dr. Sunil Kumar

Outline
• E-Mail Security Reading – Chapter 18.1,2
• Pretty Good Privacy (PGP),
• S/MIME
• Web Security
• Web Security Considerations
• Secure Electronic Transaction Protocol
• Intrusion Detection Reading..Chapter 20.1,2,3

• Password Management
• Firewalls Reading.. Chapter 22
Pretty Good Privacy (PGP)
Reading – Chapter 18.1
Pretty Good Privacy (PGP)
• PGP provides a confidentiality and authentication service that
can be used for electronic mail and file storage applications.
• Uses
• Message integrity and source authentication
• Makes message digest, signs with public key cryptosystem
• Webs of trust
• Message body encryption
• Private key encryption for speed
• Public key to encrypt the message’s private key
• History
• Written in early 1990s by Phil Zimmermann
• Primary motivation is email security
• Controversial for a while because it was too strong
• Distributed from Europe
• Now the OpenPGP protocol is an IETF standard (RFC 2440)
• Many implementations, including the GNU Privacy Guard (GPG)
Pretty Good Privacy (PGP)
• One of the protocols to provide security at the application layer is
Pretty Good Privacy (PGP). PGP is designed to create
authenticated and confidential e-mails.

• In PGP, the sender of the message needs to include the identifiers

of the algorithms used in the message as well as the values of the
keys.
 Summary of PGP Services

In PGP, there can be multiple paths from fully or partially trusted authorities to any subject.
Pretty Good Privacy (PGP)
PGP Message Format
PGP Message Generation
PGP Message Generation
1. Signing the message:
a. PGP retrieves the sender’s private key from the private-key ring using
your_userid as an index. If your_userid was not provided in the
command, the first private key on the ring is retrieved.
b. PGP prompts the user for the passphrase to recover the unencrypted
private key.
c. The signature component of the message is
constructed.
2. Encrypting the message:
a. PGP generates a session key and encrypts the message.
b. PGP retrieves the recipient’s public key from the public-key ring using
her_userid as an index.
c. The session key component of the message is constructed.
PGP Message Reception
PGP Message Reception
1. Decrypting the message:
a. PGP retrieves the receiver’s private key from the private-key ring
using the Key ID field in the session key component of the
message as an index.
b. PGP prompts the user for the passphrase to recover the
unencrypted private key.
c. PGP then recovers the session key and decrypts the message.
2. Authenticating the message:
a. PGP retrieves the sender’s public key from the public-key ring
using the Key ID field in the signature key component of the
message as an index.
b. PGP recovers the transmitted message digest.
c. PGP computes the message digest for the received message and
compares it to the transmitted message digest to authenticate.
S/MIME
Secure/Multipurpose Internet Mail Extension

Reading..18.2
S/MIME (Secure/Multipurpose
Internet Mail Extensions)
• Security enhancement to MIME email
• Original Internet RFC822 email was text only
• MIME provided support for varying content types and
multi-part messages
• With encoding of binary data to textual form
• S/MIME added security enhancements
• Have S/MIME support (e.g., signed or encryption)
in many mail agents
• MS Outlook, Mozilla, Mac Mail etc
S/MIME
• S/MIME is a security enhancement to the MIME
Internet e-mail format standard based on
technology from RSA Data Security.
• In terms of general functionality, S/MIME is very
similar to PGP.
S/MIME Functions
• Enveloped data
• encrypted content and associated keys
• Signed data
• digital signature (hash code of msg encrypted with
sender’s private key)
• encrypted msg (random sym key later encrypted)
• can be view by recipient with S/MIME
• Clear-signed data
• cleartext message + encoded signed digest
• Signed & enveloped data
• nesting of signed & encrypted entities
S/MIME Process
S/MIME Cryptographic Algorithms
• Digital signatures: DSS & RSA
• Hash functions: SHA-1 & MD5
• Session key encryption: ElGamal & RSA
• Message encryption: AES, 3DES, etc
• MAC: HMAC with SHA-1
• Must map binary values to printable ASCII
• use radix-64 or base64 mapping
Cryptographic algorithms used in
S/MIME
S/MIME Public Key Certificates
• S/MIME has effective encryption and signature
services
• But also need to manage public-keys
• S/MIME uses X.509 v3 certificates
• Each client has a list of trusted CA’s certs
• And own public/private key pairs & certs
• Certificates must be signed by trusted CA’s
• What are the five principal services provided by
PGP?
• Why does PGP maintain Key Rings with every user?
Explain how PGP generates the messages with a
neat sketch.
• List the functions included in MIME to enhance
security and how are they processed.
Web Security
Web Security
• Web now widely used by business, government,
individuals
• but Internet & Web are vulnerable
• have a variety of threats
• integrity
• confidentiality
• denial of service
• authentication
• need added security mechanisms
Secure Electronic Transactions (SET)
• open encryption & security specification
• to protect Internet credit card transactions
• developed in 1996 by Mastercard, Visa etc
• not a payment system
• rather a set of security protocols & formats
• secure communications amongst parties
• trust from use of X.509v3 certificates
• privacy by restricted info to those who need it
SET Components
SET Transaction
1. customer opens account
2. customer receives a certificate
3. merchants have their own certificates
4. customer places an order
5. merchant is verified
6. order and payment are sent
7. merchant requests payment authorization
8. merchant confirms order
9. merchant provides goods or service
10. merchant requests payment
Dual Signature
• customer creates dual messages
• order information (OI) for merchant
• payment information (PI) for bank
• neither party needs details of other
• but must know they are linked
• use a dual signature for this
• signed concatenated hashes of OI & PI
Purchase Request – Customer
Purchase Request – Merchant
Purchase Request – Merchant
1. verifies cardholder certificates using CA sigs
2. verifies dual signature using customer's public
signature key to ensure order has not been
tampered with in transit & that it was signed
using cardholder's private signature key
3. processes order and forwards the payment
information to the payment gateway for
authorization (described later)
4. sends a purchase response to cardholder
Payment Gateway Authorization
1. verifies all certificates
2. decrypts digital envelope of authorization block to obtain
symmetric key & then decrypts authorization block
3. verifies merchant's signature on authorization block
4. decrypts digital envelope of payment block to obtain
symmetric key & then decrypts payment block
5. verifies dual signature on payment block
6. verifies that transaction ID received from merchant
matches that in PI received (indirectly) from customer
7. requests & receives an authorization from issuer
8. sends authorization response back to merchant
Payment Capture
• merchant sends payment gateway a payment
capture request
• gateway checks request
• then causes funds to be transferred to merchants
account
• notifies merchant using capture response
Intrusion Detection and
Prevention systems
 Intrusion Detection/Prevention
System (IDS/IPS)
• Intrusion Detection System (IDS) and Intrusion
Prevention System (IPS) monitor network traffic to
detect and prevent malicious activities
• These systems are either implemented on a dedicated
hardware or implemented as applications on a
general-purpose server
• IDS and IPS are placed at strategic points in the
network to be able to monitor traffic from all devices

35
 Intrusion Detection/Prevention
System (IDS/IPS)
• IDS and IPS leverage a database of attacks’ signatures
to detect malicious traffic
• Signature-based IDS/IPS are popular and effective, but
cannot detect zero-day attacks
• Machine learning can be leveraged to create a model
of the normal behavior of the network
➢ Thus, the normal model can be used as a baseline to detect any abnormalities in the network

36
 Intrusion Detection System (IDS)
• An IDS monitors the traffic of a network passively
➢ i.e., the IDS is not deployed inline in the topology

• Instead, a network device (e.g., switch, router) duplicates and

forwards the traffic to the IDS
• The IDS then analyzes the traffic offline (promiscuous mode) and
matches the traffic stream with known malicious signatures
• Advantages of IDS:
➢ It does not negatively impact the performance of the network
➢ It does not affect the network if a problem or misconfiguration of the IDS occurs

• Disadvantages of IDS:
➢ It cannot stop malicious single-packet attacks from reaching the target
➢ It requires assistance from other networking devices to respond to the attack

37
Intrusion Detection System (IDS)

38
 Intrusion Prevention System (IPS)
• An IPS device monitors the network traffic actively
➢ i.e., the IPS is deployed inline in the topology

• The IPS analyzes traffic online, thus, all ingress and

egress traffic must flow through the IPS for processing
• Advantages of IPS:
➢ It can stop single packet attacks

• Disadvantages of IPS:
➢ It can negatively affect the performance of the network
➢ It can disrupt the network if a problem or misconfiguration of the IPS occurs

39
Intrusion Prevention System (IPS)

40
 Identifying Malicious Traffic on
the Network
• Signature-based IPS/IDS
➢ Set of rules looking for some specific pattern in a packet or stream of packets
➢ Most significant method used on today’s IPS/IDS
• Policy-based IPS/IDS
➢ Traffic is matched based on the security policy implemented in the network
• Anomaly-based IPS/IDS
➢ A baseline of normal and malicious behavior is modeled and compared to the traffic flowing in
the network
• Reputation-based IPS/IDS
➢ A collection of inputs from various sources is gathered, including the reputation of a certain IP
address, domain, URL, etc.

41
 IPS/IDS Evasion Techniques
• Traffic fragmentation
➢ Malicious traffic is split into multiple parts
• Traffic substitution and insertion
➢ Data payload characters are substituted into different formats
• Timing attacks
➢ Malicious traffic is sent at slow time intervals
• Encryption and tunneling
➢ Malicious traffic is encrypted and cannot be easily inspected
• Resource exhaustion
➢ Thousands of alerts are generated

42
FIREWALLS
FIREWALLS
• All previous security measures cannot prevent Eve
from sending a harmful message to a system. To
control access to a system, we need firewalls. A
firewall is a device installed between the internal
network of an organization and the rest of the
Internet. It is designed to forward some packets
and filter (not forward) others.
Firewalls
• A firewall is a system that typically sits at some point of
connectivity between a site it protects and the rest of the
network.
• It is usually implemented as an “appliance” or part of a router,
although a “personal firewall” may be implemented on an end
user machine.
• Firewall-based security depends on the firewall being the only
connectivity to the site from outside; there should be no way
to bypass the firewall via other gateways, wireless connections,
or dial-up connections.
Firewalls
• In effect, a firewall divides a network into a more-trusted zone
internal to the firewall, and a less-trusted zone external to the
firewall.
• This is useful if you do not want external users to access a
particular host or service within your site.
• Firewalls may be used to create multiple zones of trust, such as
a hierarchy of increasingly trusted zones.
• A common arrangement involves three zones of trust: the
internal network; the DMZ (“demilitarized zone”); and the rest
of the Internet.
Firewalls
• Firewalls filter based on IP, TCP, and UDP information, among
other things.
• They are configured with a table of addresses that characterize
the packets they will, and will not, forward.
• By addresses, we mean more than just the destination’s IP
address, although that is one possibility.
• Generally, each entry in the table is a 4-tuple: It gives the IP
address and TCP (or UDP) port number for both the source and
destination.
Firewalls

A firewall filters packets flowing between a

site and the rest of the Internet
 Packet-filter firewall

A packet-filter firewall filters at the network or transport layer.

Proxy Firewall

A proxy firewall filters at the application layer.