11-11-2025
Module-7
Topics to be discussed
Transport-Level Security
Firewalls
Web Security
Software Security
IoT threats
2 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
1
11-11-2025
Transport-Level Security
Transport level security provides end to end security services for
applications that use a reliable transport layer protocol such as TCP.
The idea is to provide security services for transactions on the
internet.
Two protocols are dominant today for providing security at the
transport layer.
1. Secure Sockets layer (SSL) protocol.
2. Transport Layer Security (TLS) protocol.
3 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Transport-Level Security
Location of SSL and TLS in the Internet model
4 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
2
11-11-2025
SSL Architecture
SSL is designed to provide security and compression services to data
generated from the application layer.
Topics discussed in this section:
Services
Key Exchange Algorithms
Encryption/Decryption Algorithms
Hash Algorithms
Cipher Suite
Compression Algorithms
Cryptography Parameter Generation
Session and Connections
5 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Services
Fragmentation: First, SSL divides the data into blocks of 214 bytes or
less.
Compression: Each fragment of data is compressed using one of the
lossless compression methods. This service is optional.
Message Integrity: SSL uses a keyed-hash function to create MAC to
preserve integrity of data.
Confidentiality: The original data and the MAC are encrypted using
symmetric-key cryptography to provide confidentiality.
Framing: A header is added to the encrypted payload. The payload is
then passed to reliable transport layer protocol.
6 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
3
11-11-2025
Key Exchange Algorithms
To exchange an authenticated and confidential message, the client
and the server each need six cryptographic secrets (four keys and
two initialization vectors).
To create these secrets, one pre-master secret must be established
between the two parties.
SSL defines six key-exchange methods to establish this pre-master
secret.
7 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Key Exchange Algorithms
8 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
4
11-11-2025
Key Exchange Algorithms
NULL
There is no key exchange in this method. No pre-master secret is
established between the client and the server.
Both client and server need to know the value
of the pre-master secret.
9 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Key Exchange Algorithms
RSA
RSA key exchange; server public key
10 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
5
11-11-2025
Key Exchange Algorithms
Anonymous Diffie-Hellman
Anonymous Diffie-Hellman key exchange
11 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Key Exchange Algorithms
Ephemeral Diffie-Hellman key exchange
Ephemeral Diffie-Hellman key exchange
12 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
6
11-11-2025
Key Exchange Algorithms
Fixed Diffie-Hellman
Another solution is the fixed Diffie-Hellman method. All entities in a
group can prepare fixed Diffie-Hellman parameters (g and p).
Fortezza
Fortezza is a registered trademark of the U.S. National Security
Agency (NSA).
It is a family of security protocols developed for the Defense
Department.
13 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Encryption/Decryption Algorithms
There are 6 groups of algorithms as shown below.
All block protocols use an 8-byte initialization vector (IV), except
Fortezza using 20-byte vector
14 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
7
11-11-2025
Encryption/Decryption Algorithms
NULL
The NULL category simply defines the lack of an
encryption/decryption algorithm.
Stream RC
Two RC algorithms are defined in stream mode.
Block RC
One RC algorithm is defined in block mode.
DES
All DES algorithms are defined in block mode.
15 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Encryption/Decryption Algorithms
IDEA
The IDEA algorithm defined in block mode is IDEA_CBC, with a
128-bit key.
Fortezza
The one Fortezza algorithm defined in block mode is
FORTEZZA_CBC.
16 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
8
11-11-2025
Hash Algorithm
17 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Hash Algorithm
NULL
The two parties may decline to use an algorithm.
In this case, there is no hash function and the message is not
authenticated.
MD5
The two parties may choose MD5 as the hash algorithm.
In this case, a 128-key MD5 hash algorithm is used.
SHA-1
The two parties may choose SHA as the hash algorithm.
In this case, a 160-bit SHA-1 hash algorithm is used.
18 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
9
11-11-2025
Cipher Suite
The combination of key exchange, hash, and encryption algorithms
defines a cipher suite for each SSL session
19 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Cipher Suite: SSL cipher suite list
20 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
10
11-11-2025
Compression Algorithms
Compression is optional in SSLv3.
No specific compression algorithm is defined for SSLv3.
Therefore, the default compression method is NULL.
21 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Cryptographic Parameter Generation
SSL needs six cryptographic secrets (4 keys & 2 IVs).
The client needs one key for HMAC, one key for encryption and one
IV for block encryption. The server needs same.
The parameters are generated using the following procedure:
1. The client and server exchange two random numbers.
2. The client and server exchange one pre-master secret using one
of the key-exchange algorithms.
3. A 48 byte master secret is created from the pre-master secret by
applying two hash functions (SHA-1 and MD5).
22 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
11
11-11-2025
Cryptographic Parameter Generation
Calculation of master secret from pre-master secret
23 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Cryptographic Parameter Generation
4. The master secret is used to create variable length key material
by applying the same set of hash functions and prepending with
different constants.
24 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
12
11-11-2025
Cryptographic Parameter Generation
5. Six different keys are extracted from the key material, as shown
below
Extractions of cryptographic secrets from key material
25 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Sessions and Connections
In a session, one party has the role of a client
and the other the role of a server;
in a connection, both parties have equal roles,
they are peers.
26 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
13
11-11-2025
Sessions and Connections
27 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Sessions and Connections
Session state parameters
28 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
14
11-11-2025
Sessions and Connections
Connection state parameters
29 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Sessions and Connections
The client and the server have six different
cryptography secrets: three read secrets
and three write secrets.
The read secrets for the client are the same as
the write secrets for the server and vice versa.
30 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
15
11-11-2025
Four Protocols
We have discussed the idea of SSL without showing how SSL
accomplishes its tasks.
SSL defines four protocols in two layers, as shown in next slide.
Topics in this session:
1. Handshake Protocol
2. ChangeCipher Spec Protocol
3. Alert Protocol
4. Record Protocol
31 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Four Protocols
32 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
16
11-11-2025
Handshake Protocol
It uses messages to negotiate the cipher suite, to authenticate the
server to the client and the client to the server if needed.
To exchange information for building the cryptographic secrets.
33 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Handshake Protocol
Phase I of Handshake Protocol
34 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
17
11-11-2025
Handshake Protocol
After Phase I, the client and server know the
following:
❏ The version of SSL
❏ The algorithms for key exchange, message
authentication, and encryption
❏ The compression method
❏ The two random numbers for key
generation
35 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Handshake Protocol
Phase II of Handshake Protocol
36 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
18
11-11-2025
Handshake Protocol
After Phase II,
❏ The server is authenticated to the client.
❏ The client knows the public key of the
server if required.
37 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Handshake Protocol
Four cases in Phase II
38 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
19
11-11-2025
Handshake Protocol
Phase III of Handshake Protocol
39 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Handshake Protocol
After Phase III,
❏ The client is authenticated for the server.
❏ Both the client and the server know the
pre-master secret.
40 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
20
11-11-2025
Handshake Protocol
Four cases in Phase III
41 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Handshake Protocol
Phase IV of Handshake Protocol
42 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
21
11-11-2025
Handshake Protocol
After Phase IV, the client and server are ready to
exchange data.
43 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
ChangeCipherSpec Protocol
In Handshake protocol the generation of cryptographic secrets and
the negotiation of the cipher suite is done.
SSL mandates the usage of these secrets until they have sent or
received a special message, “ChangeCipherSpec message”.
This message is exchanged during handshake protocol and defined
under ChangeCipherSpec protocol.
The sender and receiver has two states: Pending state and Active
state.
Pending state: keeps track of the secrets and parameters.
Active State: holds the parameters and secrets used by record protocol to
sign/verify messages.
This protocol defines the process of moving values between the
pending and active states.
44 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
22
11-11-2025
ChangeCipherSpec Protocol
45 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Alert Protocol
SSL uses alert protocol for reporting errors and abnormal
conditions.
46 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
23
11-11-2025
Record Protocol
The record protocol carries message from the upper layer.
The message is fragmented and optionally compressed.
A MAC is added to the compressed message using the negotiated
hash algorithm.
The compressed fragment and MAC are encrypted using the
negotiated encryption algorithm.
Finally SSL header is added to the encrypted message.
47 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Record Protocol
48 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
24
11-11-2025
Record Protocol
Calculation of MAC
49 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Transport Layer Security (TLS)
The Transport Layer Security (TLS) protocol is the IETF standard
version of the SSL protocol.
The two are very similar, with slight differences.
Topics discussed in this section:
Version
Cipher Suite
Generation of Cryptographic Secrets
Alert Protocol
Handshake Protocol
Record Protocol
50 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
25
11-11-2025
Version
The first difference is the version number (major and minor).
The current version of SSL is 3.0
The current version of TLS is 1.0
In other words, SSLv3.0 is compatible with TLSv1.0.
51 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Cipher Suite
Another minor difference between SSL and TLS is the lack of
support for the Fortezza method.
TLS does not support Fortezza for key exchange or for
encryption/decryption.
Table in the next slide shows the cipher suite list for TLS (without
export entries).
52 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
26
11-11-2025
Cipher Suite
53 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Generation of Cryptographic Secrets
Data Expansion Function
54 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
27
11-11-2025
Generation of Cryptographic Secrets
Pseudorandom Function (PRF)
55 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Generation of Cryptographic Secrets
Pre master Secret:
The generation of pre-master secret in TLS is exactly the same as in SSL.
Master Secret:
TLS uses the PRF function to create the master secret from the pre-
master secret.
56 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
28
11-11-2025
Generation of Cryptographic Secrets
Key Material:
TLS uses the PRF function to create the key material from the
master secret.
This time the secret is the master secret, the label is “key
expansion”.
57 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Alert Protocol
TLS supports all of the alerts defined in SSL except for
NoCertificate.
TLS also adds some new ones to the list.
Table in next slide shows the full list of alerts supported by TLS.
58 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
29
11-11-2025
Alert Protocol
59 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Handshake Protocol
Certificate Verify Message:
60 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
30
11-11-2025
Handshake Protocol
Hash for Finished message in TLS
61 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Record Protocol
HMAC for TLS
62 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
31
11-11-2025
FIREWALL
63 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Firewall defined
A firewall is a network security device that monitors the network’s
data traffic.
It permits or blocks data packets based on a set of security rules.
Firewalls can be software, hardware, or cloud-based, with each type
of firewall having its own unique pros and cons.
The primary goal of a firewall is to block malicious traffic requests
and data packets while allowing legitimate traffic through.
64 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
32
11-11-2025
How does a firewall work?
Firewalls carefully analyze incoming traffic based on pre-established
rules and filter traffic coming from suspicious sources to prevent
attacks.
Firewalls guard traffic at a computer’s entry point, called ports, which is
where information is exchanged with external devices.
For example, “Source address [Link] is allowed to reach destination
[Link] over port 22."
65 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
How does a firewall work?
Think of IP addresses as houses, and port numbers as rooms within
the house.
Only trusted people (source addresses) are allowed to enter the
house (destination address).
Further filtered people within the house are only allowed to access
certain rooms (destination ports),
Depending on if they're the owner, a child, or a guest.
The owner is allowed to any room (any port), while children and
guests are allowed into a certain set of rooms (specific ports).
66 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
33
11-11-2025
Types of Firewall
Firewall types can be divided into several different categories based
on their general structure and method of operation.
Here are eight types of firewalls:
Packet-filtering firewalls
Circuit-level firewalls/gateways
Stateful inspection firewalls
Application-level gateways (a.k.a. proxy firewalls)
Next-gen firewalls
Software firewalls
Hardware firewalls
Cloud firewalls
67 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Packet-Filtering Firewalls
It is the most “basic” and oldest type of firewall architecture.
It basically creates a checkpoint at a traffic router or switch.
The firewall performs a simple check of the data packets coming
through the router
inspecting information such as the destination and origination IP address,
packet type, port number, and other surface-level information.
These firewalls aren’t very resource-intensive thereby, impact on
system performance and are relatively simple.
However, they’re also relatively easy to bypass compared to firewalls
with more robust inspection capabilities.
68 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
34
11-11-2025
Circuit-Level Gateways
Another simplistic firewall which works quickly and easily approve or
deny traffic without consuming significant computing resources.
Circuit-level gateways work by verifying the transmission control
protocol (TCP) handshake.
This TCP handshake check is designed to make sure that the session
the packet is from is legitimate.
While extremely resource-efficient, these firewalls do not check the
packet itself.
So, if a packet held malware, but had the right TCP handshake, it
would pass right through.
This is why circuit-level gateways are not enough to protect your
business by themselves.
69 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Stateful Inspection Firewalls
State-aware devices, on the other hand, not only examine each
packet, but also keep track of whether or not that packet is part of
an established TCP or other network session.
These firewalls combine both packet inspection technology and TCP
handshake verification.
This offers more security than either packet filtering or circuit
monitoring alone.
However, these firewalls do put more of a strain on computing
resources and network performance.
70 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
35
11-11-2025
Proxy Firewalls (Application-Level Gateways)
Proxy firewalls operate at the application layer to filter incoming
traffic.
These firewalls are delivered via a cloud-based solution or another
proxy device.
Rather than letting traffic connect directly, the proxy firewall first
establishes a connection to the source of the traffic and inspects the
incoming data packet.
Also perform deep-layer packet inspections, checking the actual
contents of the information packet to verify that it contains no
malware.
Once the check is complete, and the packet is approved to connect
to the destination, the proxy sends it off.
71 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Proxy Firewalls (Application-Level Gateways)
This creates an extra layer of separation between the client and the
individual devices
obscuring them to create additional anonymity and protection for your
network.
If there’s one drawback to proxy firewalls, it’s that they can create
significant slowdown because of the extra steps in the data packet
transferal process.
72 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
36
11-11-2025
Next-Generation Firewalls
Many of the most recently-released firewall products are being
touted as “next-generation” architectures.
Some common features of next-generation firewall architectures
include deep-packet inspection, TCP handshake checks, and surface-
level packet inspection.
Next-generation firewalls may include other technologies as well,
such as Intrusion Prevention Systems (IPSs) that work to
automatically stop attacks against your network.
The issue is that there is no one definition of a next-generation
firewall
73 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Software Firewalls
Software firewalls include any type of firewall that is installed on a
local device rather than a separate piece of hardware
The big benefit of a software firewall is that it's highly useful for
creating defense in depth by isolating individual network endpoints
from one another.
However, maintaining individual software firewalls on different
devices can be difficult and time-consuming.
Furthermore, not every device on a network may be compatible
with a single software firewall.
74 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
37
11-11-2025
Hardware Firewalls
Hardware firewalls use a physical appliance that acts in a manner
similar to a traffic router.
Act as a perimeter security by making sure malicious traffic is
intercepted before the company's network endpoints.
The major weakness of a hardware-based firewall, however, is that it
is often easy for insider attacks to bypass them.
75 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Cloud Firewalls
Whenever a cloud solution is used to deliver a firewall, it can be
called a cloud firewall, or firewall-as-a-service (FaaS).
Cloud firewalls are considered synonymous with proxy firewalls by
many, since a cloud server is often used in a proxy firewall setup.
The big benefit of having cloud-based firewalls is that they are very
easy to scale with your organization.
As your needs grow, you can add additional capacity to the cloud
server to filter larger traffic loads.
Cloud firewalls, like hardware firewalls, excel at perimeter security.
76 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
38
11-11-2025
Web Security
Web security is also known as “Cybersecurity”.
It basically means protecting a website or web application by
detecting, preventing and responding to cyber threats.
Websites and web applications are just as prone to security breaches
as physical homes, stores, and government locations.
There are a lot of factors that go into web security and web
protection.
Any website or application that is secure is surely backed by different
types of checkpoints and techniques for keeping it safe.
77 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Web Security
There are different types of technologies available for maintaining the
best security standards.
Some popular technical solutions for testing, building, and preventing
threats include:
Black box testing tools
Fuzzing tools
White box testing tools
Web application firewalls (WAF)
Security or vulnerability scanners
Password cracking tools
78 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
39
11-11-2025
Software Security
Security software is any type of software that secures and protects a
computer, network or any computing-enabled device.
Security software is a broad term that encompasses a suite of
different types of software that deliver data and computer and
network security in various forms.
In end-user computing environments, anti-virus and anti-spam
software is the most common type of software used.
Whereas enterprise users add a firewall and intrusion detection
system on top of it.
79 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
IoT Threats
Anything that has connection to Internet is prone to threats.
Any threat on IoT is backed by a purpose. The purpose may differ
depending upon intruder’s target:
Since IoT enabled devices are used and operated by humans, an
intruder may try to gain unauthorized access to the device.
By gaining access to wireless IoT devices, the intruder may get hold
of confidential information.
IoT devices require low power and less computational capability.
Due to this, they cannot afford to have complex protocols. Therefore it
becomes an easy target for intruders.
80 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
40
11-11-2025
IoT Threats
Vulnerability of IoT Devices:
There are two types of vulnerability: hardware and software.
A hardware vulnerability is difficult to detect.
However, it is more difficult to repair the damage.
Software vulnerability points towards a poorly written algorithm with a
back door.
Thus providing access to intruders for spying at such moments.
81 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
IoT Threats
Easy Exposure of IoT Devices:
Any device that is not attended or exposed to troublemakers is an
open invitation for threats.
In majority cases, IoT devices are prone to third-party exposure –
they either lay open or accessible to anyone.
Which means that an intruder can easily steal the device and connect it
with another device containing harmful data.
Thus extracting cryptographic secrets, modifying programming and
replacing devices with a malicious one.
82 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
41
11-11-2025
IoT Threats
Threats to IoT:
There are two types of threat to IoT human threat and a natural
threat.
Any threat that occurs due to natural calamities like earthquakes,
hurricanes, the flood can cause severe damage to IoT devices.
In such cases, a back is created to safeguard data.
But any damage to these devices cannot be repaired.
On the other hand, we do everything to curb human threats to IoT
devices.
These threats are malicious attacks.
83 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
IoT Threats
Human Attacks on IoT Devices:
Cyber Reconnaissance:
Here intruder uses cracking techniques and malicious software to
conduct espionage on the targeted user to gain access to secret
information on the existing systems.
Brute Force Attack :
Here the intruders make an attempt to guess user’s password with help
of automated software, which makes several attempts unless it gets the
right password to grant access.
Tracking:
User’s each move is captured using UID of IoT device. Tracking a user
gives away precise location in time where they wish to live.
84 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
42
11-11-2025
Summary
In this module we discussed all security aspects required to establish
a network towards data sharing.
85 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
43