1
Introduction
Dr. Mahendra Pratap Singh
Assistant Professor
Dept. of Computer Science and
Engineering
Present Scenario
Information Security Advice
WhatsApp has become a common
messenger now a days.
With the help of mobile you can check
the profile photo of the particular user.
This may not be safe if the number falls
into wrong hands.
They may misuse your photo.
To avoid this, set the privacy settings of
your profile photo only to my contacts.
Why
4 We Should Care about Security ?
• We use internet for many things
• Online banking
• Online shopping
• Booking tickets …
• We store many things in computers
• Photos
• Files
• Credit Card Number…..
5
Vulnerability and Attack
Vulnerability: a weakness in
system which allows a malicious
user to gain access.
Attack: a successful strategy to exploit a
vulnerability in order to gain illegal access.
• Active
• Passive
Attacker: someone who crafts an attack
• Insider attacker- e.g., Employee, Vendor,
Partner
• Outside attacker- e.g., Cyber-criminals, Spies,
Hackers, Malware, Nation-state intelligence
agencies, etc.
6
Types of Attackers
• Attacker – Someonewho can find an exploitable
bug in a computer system.
• Cracker – An attacker who exploit a system illegally.
• Script kiddies – Uses tools available publicly to exploit a
system.
• White hacker- People who discover vulnerabilities but
does not exploit.
• They help to fix it.
• Black hacker – Bad people who want to exploit
systems
after discovery.
• Cyber terrorists – Often have religious and
fundamentalist mindset.
• Cyber army – State sponsored attackers.
• Work for nation’s strategic security.
Active Attack
An active attack attempts to alter system resources or affect
their operations.
Passive Attack
A passive attack attempts to learn or make use of information
from the system but does not affect system resources.
Threat
A threat is a possible danger that might exploit a vulnerability
to breach security.
Network and System
Attacks
10
Information Gathering
Buffer Overflow Attacks
Format String Attacks
SQL Injection Attacks
Spoofing Attacks
Phishing Attacks
DoS Attacks
Virus, Worms, Trojan Horse
Session Hijacking
Snooping or Sniffing
OS and Unix System
Security
Botnets
Spamming
Defense
Mechanisms
11
Antivirus
Authentication
Proxy Servers
IDS
Firewall
Email Security
Cryptography
PGP
Digital
Signatures
Kerberos
IPsec
Web Security
Who Are Vulnerable to Attacks ?
12
• Financial institutions
• Defense organizations
• Government agencies
• Pharmaceutical companies
• IT companies
• Intellectual property
management companies
• Academic institutions
• Everyone connected to internet
13
CIA Principles of Security
Information securit is defined by
acronym y an
CIA
Confidentiality: Avoiding
unauthorized
disclosure of information.
Integrity: An assurancethat
information
is not altered midway of transmission.
Availability: An assurance of
information access and modification
in a reasonable timeframe.
14
AAA Principles of Security
AAA stand for Assurance,
Authenticity and Anonymity
Assurance asks for guarantee.
Authenticity asks to tell you “who are
you”.
Anonymity asks not to reveal identity.
Bob, Alice want to communicate
“securely”
15
Trudy is an enemy (intruder): “bad”
guy
Q: what should Bob & Alice be concerned confidentialit
about? y
integrit
eavesdrop: messages are intercepted
y
change: messages are modified
authenticatio
impersonation: entire communication is n
hijacked by availabilit
replacing sender or receiver by himself y
denial of service: prevent services (e.g.,
by overloading resources) Bo
Alic Message
e s b
dat sende receive dat
a r r a
Trudy
16
Who might Bob, Alice be?
… well, real-life Bobs and Alices!
Web browser/server for electronic
transactions (e.g., on-line purchases)
on-line banking client/server
DNS servers
routers exchanging routing table
updates
17
What is network security?
Goals of network security:
Confidentiality: Only sender, intended receiver should
“understand” message contents
sender encrypts message
receiver decrypts message
Authentication: Sender and receiver want to confirm
identity of each other.
Integrity: Sender and receiver want to ensure message
not altered (in transit, or afterwards) without
detection.
Availability: Services must be accessible and available to
users.
18
Roadmap
Principles of
cryptography
Message integrity
Cryptography
Cryptography allows a sender to disguise a
message so that an intruder can’t gain
information from it.
“confidentiality”
Alice’s Bob’
K encryptio K sdecryptio
A
n key Bn
plaintex encryptio ciphertex key
decryption plaintext
t n t algorith
algorith m
m
All terms marked in red
are crypto 14
20 Types of cryptography
Symmetric key
- Both sender and receiver use identical
key
e.g., Sender A encrypts with the key
Receiver B decrypts with same key
Public/private keys
- Two keys (public and private) are to be
used
e.g., Sender A encrypts with B’s public
key Receiver B decrypts with its
Private key
21 Symmetric key
cryptography
KA- KA-
B B
plaintext encryptio ciphertex decryption plaintext
message, n t algorith
m algorith K m m=
A-B A-B ( KA-B
m (m) K
(m) )
Symmetric key crypto: Bob and Alice
share/know same (symmetric) key:A-BK
Q: How do Bob and Alice agree on key
value?
22 Public key cryptography
Public key cryptography
Symmetric key crypto
Radically different
Requires sender,
approach
receiver know
Two keys
shared secret key
Q: How to agree on Public key: encryp. key
key in first place known to all
(particularly if never
“met”)?
Private key: decryp.
key known only to
receiver
Sender uses public key
only to encryp
Reciever uses both keys
23 Public key cryptography
Bob’s public
KB key
+
- Bob’s
K private
B
key
plaintext encryptio ciphertex decryptio plaintex
message, n t n t
algorith K B+ algorith
-
m messag
m (m) m
B
+ B
e
m = K (K
(m))
Note: Only Bob is able to understand (decrypt)
message m. Because only Bob has Bob’s private
key.
This assures “confidentiality”.
24 Public key encryption
algorithms
Requirement
s:
+ .
- ( ) such
.and B
1 Need KB-( ) +
K (K =
that
K B B
(m)) m
+
2 Given public key KB , it
impossible to
should be -
compute
private key KB
RSA: Rivest, Shamir, Adleman
algorithm
25
Roadmap
Principles of
cryptography
Message integrity
Message
Integrity/Authentication
26
Bob receives msg from Alice, wants to
ensure:
Authentication: message originally came from Alice
Integrity: message not changed since sent by Alice
Cryptographic Hashing:
What:
Takes input m and produces fixed length value H(m).
e.g., as in Internet checksum
Properties of H:
Given m = H(x), (x unknown), it is computationally
infeasible to determine x.
Difficult to find x and y such that H(x) = H(y)
Note: Internet checksum fails this requirement!
Examples
Widely used hash functions: MD5, SHA
MAC: Message Authentication
Code (shared
secret)s
H(m+
s)
(messag H(.
e) m H(m+ m)
public
m appe s) compa
Internet re
nd H(m+
s)
H(m+
H(. s)
s )
(shared
secret) Any problem ??
Does MAC solve Secret key distribution ??
Integrity ?? How ??
So we can’t really
via Hashing authenticate via MAC
Authentication ?? alone.
How ?? 22
Digital
28 Signatures via Public Key
Crypto
Simple digital signature for message m:
Bob “signs” m by encrypting with his
private
-
key -
KB, creating “signed” message, KB(m)
- Bob’s -
Bob’s message, KB KB
m ke
private (m)
Dear Alice y Bob’s
Oh, how I have public message, m,
missed you. I think
of you all the time! key signed
…(blah blah blah) encryptio (encrypted)
Bo
n with his
b
algorithm private key
Digital
29
Signatures via Public Key Crypto
(more) -
Suppose Alice receives msg m, digital signature
K B(m)verifies m
Alice signed by Bob by applying
-
Bob’s
public key KB to K
+
- B(m) then checks KB(KB(m) ) =
+
m. + -
if KB(KB(m) ) = m, whoever signed m must
have used Bob’s private key.
Alice thus verifies that:
Bob signed m.
No one else signed m.
Bob signed m and not m’.
-
MAC via private/public
keys
30
Alice’s public
key
+
KA -
m
K
(m)
(messag - - A
K
e) m K
A
(m) public (m)
m appe A compa
Internet re
nd m m
-
m K
(m)
A
-
KA
Alice’s private
key
Note: Only Alice would have had her private
key
This assures “authentication”.
Digital
31
Signatures via Public Key Crypto
(more)
Problem
Signing data by encryption and decryption is
computationally expensive.
Imagine encrypting (signing) huge files of data !!!
Solution
Sign hashed output of original msg (sign H(m)
only).
Recall hash algorithms turn large msgs into small,
fixed
length msg.
-
… signed MAC is the solution
Digital signature = signed MAC
32
= authentication +
integrity Alice verifies signature
Bob sends digitally and
integrity of digitally
signed signed
message:
large message:
messag H: encrypte
em hash H(m
msg
d
functio ) -
digest
n digital
Bob’ large KB(H(m))
s signatur messag
- Bob’
privat
KB e em digital
e s
(encrypt + signatur
k publi KB
)
encrypte H: c e
ey (decrypt
d
msg hash ke
-
+ digest functio y )
n H(m H(m
KB(H(m))
) )
equ
al
?
33 Public Key Certification
Problem with public key:
When Alice obtains Bob’s public key
(from web site, e-mail, diskette), how
does she know it is Bob’s public key, not
Trudy’s?
Solution:
Trusted certification authority (CA)
Reca
34
p
So far: Note: Sender
Cryptography &
applies receiver’s
confidentiality public key
Public key: A
Symmetric wants to send msg m to B. What does A
key
send?
A sends KB+(m); hence, ONLY B understands m by
applying KB-
(KB+(m))
Authentication & Note: Sender
=> confidentiality
integrity applies its private
MAC (Msg Authen. Code): key
requires symmetric key
A sendsMAC:
Signed (m,K-AA(m))
-> Bto
Hence,
B, All get m by applying
A
K +(K -(m));
A
Comparison => authen. + integrity, but NOT
confidentiality
Secure e-mail
(confidentiality)
35
Alice wants to send confidential e-mail, m, to
Bob.
KS
m KS(m ) KS(m ) m
KS( . KS ( .
A ) + Internet
- )
B
+ -
KS + KK
K (. KB(K + BS
B
+ ) S KB(KS )
-( ).
K) B KB
Alice generates random symmetric private key, KS.
Secure e-mail (authen. +
36
• integrity)
Alice wants to provide sender
authentication/integrity.
- +
KA KA
- -
m H( . -
KA KA(H(m) KA(H(m) +
KA H(m
) ) )
A .
( ) .
( )
) + Internet
- compar
e B
m
H( .
H(m
m
)
)
•Alice digitally signs message.
• sends both message (in the clear) and digital
signature.
Again note that to provide authenticate/integrity,
sender encrypts with its private (all can understand
Secure
37
e-mail (all: confid. + auth. +
integrity)
• Alice wants to provide secrecy, sender
authentication, message integrity.
-
KA
-
m H( . -
KA KA(H(m) KS
)
.
( )
A ) +
KS( .
m ) + Internet
+
KS +
K (.B
KB(K
S
+ )
K) B
Alice uses three keys: her private key, Bob’s
public key, and newly created symmetric key.
38
The end of
Introduction!