Chapter VI: Network Security

By: Dr. Jaber M. Jaber

18 March 2020

Contents
IPv4.......................................................................................................................................................... 3
Definition ............................................................................................................................................ 3
IPv4 Packet Format ............................................................................................................................. 3
TCP/IP Architecture............................................................................................................................. 4
Limitations of IPv4 .............................................................................................................................. 4
IPv6.......................................................................................................................................................... 4
Definition ............................................................................................................................................ 4
IPv6 Packet Format ............................................................................................................................. 5
IP Security (IPsec) .................................................................................................................................... 5
Definition ............................................................................................................................................ 5
Uses of IPsec ....................................................................................................................................... 5
Authentication Header (AH) ............................................................................................................... 5
ESP Header .......................................................................................................................................... 6
Security Association (SA)..................................................................................................................... 6
IPSec Implementation ......................................................................................................................... 7
Key Management in IPSec................................................................................................................... 7
IPSec Architecture ............................................................................................................................... 7
IPSec Operational Modes.................................................................................................................... 7
Virtual Private Network (VPN) ............................................................................................................ 8
Routing Security ...................................................................................................................................... 8
Context ................................................................................................................................................ 8
General Addressing Principles ............................................................................................................ 8
Names Management........................................................................................................................... 9
Route ................................................................................................................................................... 9
Routers Security .................................................................................................................................. 9
Names Servers Security ...................................................................................................................... 9
Security & Access Management ........................................................................................................... 10
Access Control ................................................................................................................................... 10
Digital Certificates ............................................................................................................................. 10
Management Of Access Authorizations Via A Names Server ........................................................... 10
Access Control Based On Biometric Data ......................................................................................... 10
Network Security .................................................................................................................................. 10

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 2 of 10

IPv4
Definition
Internet Protocol version 4 (IPv4) is the fourth version of the Internet Protocol. It is one of the core
protocols of standards-based internetworking methods in the Internet and other packet-switched
networks.

IPv4 Packet Format

Notes:
 Overall Blue Size: 20 bytes and it’s called IPv4 header.
 IP Option + Data to transmit: Variable size.

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 3 of 10

TCP/IP Architecture

Limitations of IPv4
 The lack of address space
 Weak protocol extensibility
 The problem of security of communications
 Lack of quality of service support
 Geographic limitations

IPv6
Definition
Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol, the
communications protocol that provides an identification and location system for computers on
networks and routes traffic across the Internet. IPv6 is intended to replace IPv4.

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 4 of 10

IPv6 Packet Format

Notes:
 Overall Gray Size: 40 bytes and it’s called IPv4 header.
 IP Option + Data to transmit: Variable size.

IP Security (IPsec)
Definition
 Suite of protocols providing encryption and authentication at the IP layer.
 Objective is to encrypt and/or authenticate all traffic at the IP level.

Uses of IPsec
 Virtual Private Network (VPN) establishment for connecting remote offices and users using
public Internet.
 Low-cost remote access: e.g. teleworker gains secure access to company network via local call
to ISP.
 Extranet connectivity: Secure communication with partners, suppliers, etc.

Authentication Header (AH)

 Provides authentication but not confidentiality.
 Adds extra field to traditional IP packet; used to verify authenticity of the packet.

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 5 of 10

ESP Header
 ESP: Encapsulating Security Payload.
 Provides packet encryption and, optionally, authentication.
 Content of IP packet is encrypted and encapsulated between header and trailer fields.

Security Association (SA)

 In order to communicate, each pair of hosts must set up SA with each other.
 Acts as virtual connection for which various parameters are set:
 Type of protection
 Algorithms
 Keys
 …
 Specifies one-way relationship.

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 6 of 10

  For either AH or ESP, but not both.
 Each SA uniquely identified by:
 Security Parameters Index (SPI): 32-bit string assigned to this SA (local meaning only)
 IP destination address of packets: May be end user system, or firewall or router
 Choice of AH or ESP
 For each IP packet, governing SA is identified by:
 Destination IP address in packet header
 SPI in extension header (AH or ESP)

IPSec Implementation
 Security Association Database
 Security Policy Database

Key Management in IPSec

 Generation and distribution of secret keys
 Two alternative:
 Manual: Done by the system administrator and suitable for small and static environments.
 Automated: Suitable for large environments and uses a key exchange protocol such as
Oakley Key Determination Protocol, Internet Security Association and Key Management
Protocol, and Internet Key Exchange.

IPSec Architecture
 DOI: Domain Of Interpretation
 Security politic is below key management

IPSec Operational Modes

Two operational modes:
 Transport Mode:
 Protects/encrypts user’s data only
 Typically used for end-to-end communication
 Tunnel Mode:
 Protects/encrypts entire IP packet (header and user’s data)
 Typically used for connecting secure gateways (firewalls or routers that implement
IPsec)
 Hosts don’t need to be IPsec-enabled
Notes:
 The first picture below is about a regular IPv4 packet without IPSec.

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 7 of 10

  Payload is also called user’s data.

Virtual Private Network (VPN)

 Uses public (insecure) Internet for parts of network connectivity.
 Made possible by use of cryptography.
 Can be enabled by IPsec among other methods as shown below.
 In the picture below, an IPSec-enabled router can replace the firewall.

Routing Security
Context
 Secure routing processes of data inside the network.
 Routers.
 Naming Servers.

General Addressing Principles

 MAC Address: Physical address provided by the manufacturer of the networking device.
 IP Address: Network address that can be used to send and receive IP packets.
 IPv4 Address Length: 32 bits.
 IP address is independent of MAC address.
 ARP (Address Resolution Protocol) is used to map IP addresses to the hardware MAC
addresses.

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 8 of 10

  RARP (Reverse Address Resolution Protocol) allows a system to use its MAC address to
determine its IP address.
 ARP and RARP are no longer used in IPv6.
 BOOTP and DHCP protocols can be used to obtain an IP address without using RARP protocol.
 DHCP is much more efficient that BOOTP.
 DHCP works in client/server mode.
 DHCP Server

Names Management
 Name – IP Address Mapping.
 Directory Services.
 DIT: Directory Information Tree.
 DIB: Directory Information Base.
 Domain Names: [Link], [Link], [Link], etc.
 Sub-Domain Names: [Link], [Link], etc.
 Top Level Domains (TLDs):
 .com: commercial
 .net: network
 .edu: educational
 .gov: governmental
 Etc.
 DNS Servers: A DNS server is a computer server that contains a database of public IP addresses
and their associated hostnames, and in most cases serves to resolve, or translate, those names
to IP addresses as requested.
 LDAP Protocol: LDAP (Lightweight Directory Access Protocol) is a software protocol for
enabling anyone to locate data about organizations, individuals, and other resources such as
files and devices in a network - whether on the public Internet or on a corporate intranet.

Route
 A route is a path between two entities: source and destination.
 A path may be direct or indirect.

Routers Security
 A router is a networking device that forwards data packets between computer networks.
 It’s very important to protect the routing function so it cannot be altered by unauthorized
users.

Names Servers Security

 Access Control
 Authentication
 Surveillance
 Encryption
 Redundancy
 Etc.

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 9 of 10

Security & Access Management
Access Control
 Logical Access Control
 Identity Management
 Authorization Management
 Identity Proof Management
 User Profile
 Password Rules

Digital Certificates
 PKI
 Certificate Authority
 Certificate Revocation List
 Client Certificate
 Server Certificate

Management Of Access Authorizations Via A Names Server

 Back-Up
 Synchronization & Cooperation
 Meta-Directory

Access Control Based On Biometric Data

 No need of passwords
 Use physical “biometric” characteristics of people like fingerprint, eye, sound, etc.
 Double control: Password + biometric data

Network Security
 Protection of the transmission infrastructure
 Protection of the transport network
 Protection of application flows and the user’s sphere
 Optimal protection
 Cloud security
 Cloud: Generic services on demand
 Software as a Service (SaaS)
 Platform as a Service (PaaS)
 Infrastructure as a Service (IaaS)
 Advantages & disadvantages of the cloud

Chapter VI: Network Security By: Dr. Jaber M. Jaber Page 10 of 10