Computer Networks
CSE-3203
Network Security
Istyaque Ahammed
Lecturer
Department of Computer Science and Engineering
North Western University, Khulna
Chapter Goals
Understand principles of network security:
cryptography and its many uses beyond “confidentiality”
authentication
message integrity
Security in practice:
firewalls and intrusion detection systems
security in application, transport, network, link layers
2
What is network security?
Confidentiality: only sender, intended receiver should
“understand” message contents
sender encrypts message
receiver decrypts message
Authentication: sender, receiver want to confirm identity of
each other
Message integrity: sender, receiver want to ensure message
not altered (in transit, or afterwards) without detection
Access and availability: services must be accessible and
available to users 3
Friends and enemies: Alice, Bob, Trudy
Well-known in network security world
Bob, Alice (lovers!) want to communicate “securely”
Trudy (intruder) may intercept, delete, add messages
4
There are bad guys (and girls) out there!
Q: What can a “bad guy” do?
A: a lot!
– eavesdrop: intercept messages
– actively insert messages into connection
– impersonation: can fake (spoof) source address in packet
(or any field in packet)
– hijacking: “take over” ongoing connection by removing
sender or receiver, inserting himself in place
– denial of service: prevent service from being used by others
(e.g., by overloading resources) 5
The language of cryptography
Symmetric key crypto: sender, receiver keys identical
Public-key crypto: encryption key public, decryption key secret
(private)
6
Symmetric key cryptography
7
Symmetric key crypto: DES
DES: Data Encryption Standard
• US encryption standard [NIST 1993]
• 56-bit symmetric key, 64-bit plaintext input
• How secure is DES?
– DES Challenge: 56-bit-key-encrypted phrase (“Strong
cryptography makes the world a safer place”) decrypted (brute
force) in 4 months
– no known “backdoor” decryption approach
• making DES more secure:
– use three keys sequentially (3-DES) on each datum use cipher-
block chaining 8
AES: Advanced Encryption Standard
• New (Nov. 2001) symmetric-key NIST standard, replacing DES
• Processes data in 128 bit blocks
• 128, 192, or 256 bit keys
• Brute force decryption (try each key) taking 1 sec on DES, takes
149 trillion years for AES
9
Public key cryptography
Symmetric key crypto
• Requires sender, receiver know shared secret key
• Q: how to agree on key in first place (particularly if never
“met”)?
Public key cryptography
• Radically different approach [Diffie-Hellman76, RSA78]
• Sender, receiver do not share secret key
• Public encryption key known to all
• Private decryption key known only to receiver 10
Message Integrity
Bob receives msg from Alice, wants to ensure:
• Message originally came from Alice
• Message not changed since sent by Alice
Cryptographic Hash:
• Takes input m, produces fixed length value, H(m)
– e.g., as in Internet checksum
• computationally infeasible to find two different
messages, x, y such that H(x) = H(y)
– equivalently: given m = H(x), (x unknown), can not determine x.
– note: Internet checksum fails this requirement! 11
Digital Signatures
Cryptographic technique analogous to hand-written
signatures.
• Sender (Bob) digitally signs document, establishing he is
document owner/creator.
• Verifiable, nonforgeable: Recipient (Alice) can prove to
someone that Bob, and no one else (including Alice), must have
signed document.
12
Certification Authorities
• When Alice wants Bob’s public key:
– gets Bob’s certificate (Bob or elsewhere).
– apply CA’s public key to Bob’s certificate, get Bob’s public
key
13
Certification Authorities (Cont…)
14
Secure sockets layer (SSL)
• Provides transport layer security to any TCP-based application
using SSL services.
– e.g., between Web browsers, servers for e-commerce (shttp)
• Security services:
– server authentication, data encryption, client authentication (optional)
15
SSL: three phases
1. Handshake
2. Key Derivation
3. Data transfer
16
Firewalls
• Isolates organization’s internal net from larger Internet,
allowing some packets to pass, blocking others.
17
Thank You
18