Network Security

8-1
Topics
 Need for Security of Computer Networks
 Transport layer security:
 Secure Socket Layer (SSL),
 IP Security: transport and tunnel modes,
 E-mail Security: PGP and S/MIME.

8: Network Security 8-2

What is network security?
Confidentiality: only sender, intended receiver
should “understand” message contents
 sender encrypts message
 receiver decrypts message

Authentication: sender, receiver want to confirm

identity of each other
Message integrity: sender, receiver want to
ensure message not altered (in transit, or
afterwards) without detection
Access and availability: services must be
accessible and available to users

8: Network Security 8-3

Who might Bob, Alice be?
 Web browser/server for electronic
transactions (e.g., on-line purchases)
 on-line banking client/server
 DNS servers
 routers exchanging routing table
updates

8: Network Security 8-4

There are bad guys out there!
 eavesdrop: intercept messages
 actively insert messages into connection
 impersonation: can fake (spoof) source
address in packet (or any field in packet)
 hijacking: “take over” ongoing connection
by removing sender or receiver, inserting
himself in place
 denial of service: prevent service from
being used by others (e.g., by overloading
resources)

8: Network Security 8-5

 Secure e-mail
 Alice wants to send confidential e-mail, m, to Bob.
KS

m K (.)
KS(m KS(m
KS( ) . m
S ) )
+ Internet - KS

KS
+.
K ()
B + +
-
KB( )
.
KB(KS ) KB(KS )
+ -
KB
KB

Alice:
 generates random symmetric private key, KS.
 encrypts message with KS (for efficiency)
 also encrypts KS with Bob’s public key.
 sends both KS(m) and KB(KS) to Bob.
8: Network Security 8-6
 Secure e-mail
 Alice wants to send confidential e-mail, m, to Bob.
KS

m K (.)
KS(m KS(m
KS( ) . m
S ) )
+ Internet - KS

KS
+.
K ()
B + +
-
KB( )
.
KB(KS ) KB(KS )
+ -
KB
KB

Bob:
 uses his private key to decrypt and
recover KS
 uses K to decrypt K (m) to recover m
S S
8: Network Security 8-7
 Secure e-mail (continued)
• Alice
wants to provide sender authentication
message integrity.

- KA
+
KA
- -
m H( ). -.
K ()
A
KA(H(m)) KA(H(m)) +
KA( )
. H(m )

+ Internet - compare

m H( ). H(m )
m

• Alice digitally signs message.

• sends both message (in the clear) and digital signature.

8: Network Security 8-8

 Secure e-mail (continued)
• Alice
wants to provide secrecy, sender authentication,
message integrity.
-
KA
-
m .
H( )
-
KA( )
. KA(H(m))
KS

+ KS( ).
m + Internet

KS
+
KB( )
. +
KB(KS )
+
KB

Alice uses three keys: her private key, Bob’s

public key, newly created symmetric key
8: Network Security 8-9
Pretty good privacy (PGP)
 Internet e-mail A PGP signed message:
encryption scheme, de-
---BEGIN PGP SIGNED MESSAGE---
facto standard. Hash: SHA1
 uses symmetric key
cryptography, public key Bob:He is out of the way, Alice
cryptography, hash ---BEGIN PGP SIGNATURE---
function, and digital Version: PGP 5.0
signature as described. Charset: noconv
 provides secrecy, sender yhHJRHhGJGhgg/
12EpJ+lo8gE4vB3mqJhFEvZP9t6n7G
authentication, integrity. 6m5Gw2
---END PGP SIGNATURE---

8: Network Security 8-10

 PGP
 PGP employs a hybrid cryptographic method,
combining symmetric-key and public-key
cryptography techniques.
 Symmetric-key cryptography entails the use
of a single mystery key to each encrypt and
decrypt statistics.
 Conversely, public-key cryptography utilizes
a pair of mathematically associated keys: a
public key, that is freely shared and used for
encryption, and a personal key, that is stored
in mystery and used for decryption.
8: Network Security 8-11
Services offered by PGP:

1. Authentication
2. Confidentiality
3. Email Compatibility
4. Segmentation

8: Network Security 8-12

S/MIME -Secure/Multipurpose
Internet Mail Extensions
 S/MIME can do both symmetric
encryption and digital signatures, for
securing emails
 Symmetric encryption guarantees that
only the addressee will be able to read
your email, and digital signatures
(Authentication, Integrity)
 With S/MIME, we can protect your
communication against unwanted
readers and establish trust with those
receiving your emails.
8: Network Security 8-13
S/MIME - Working
 S/MIME enables non-ASCII data to be sent
using Secure Mail Transfer Protocol (SMTP) via
email.
 The data which is encrypted using a public key
is then decrypted using a private key which is
only present with the receiver of the E-mail.
 The receiver then decrypts the message and
then the message is used.
 In this way, data is shared using e-mails
providing an end-to-end security service using
the cryptography method.

8: Network Security 8-14

S/MIME –
Encryption / Decryption

8: Network Security 8-15

Advantages of S/MIME
 It offers verification.
 It offers integrity to the message.
 By the use of digital signatures, it
facilitates non-repudiation of origin.
 It offers seclusion.
 Data security is ensured by the
utilization of encryption.
 Transfer of data files like images, audio,
videos, documents, etc. in a secure
manner.
8: Network Security 8-16
S/MIME is supported by most
major email clients
 Apple Mail,
 Gmail,
 IMB Notes,
 iPhone iOS Mail,
 Microsoft Outlook, and
 Mozilla Thunderbird.

8: Network Security 8-17

Secure sockets layer (SSL)
 provides transport layer security to any TCP-based
application using SSL services.
 e.g., between Web browsers, servers for e-commerce
(shttp)
 security services:
 server authentication, data encryption, client
authentication (optional)
Application
Application
SSL sublayer SSL
TCP TCP TCP socket
socket
IP IP
TCP API TCP enhanced with SSL

8: Network Security 8-18

 Transport layer security service
 originally developed by Netscape
 version 3 designed with public input
 Subsequently became Internet standard
Transport Layer Security (TLS)
 Use TCP to provide a reliable end-to-end
service
 May be provided in underlying protocol suite
transparent to apps)
 Or embedded in specific packages (WWW
browsers)

8: Network Security 8-19

Two Important SSL
Concepts
 SSL session: an
association between a
client and a server
created by the
Handshake protocol

 SSL connection: a
transport layer, peer-to-
peer, short-live
connection
 Every connection is
associated with one session
SSL Record Protocol
Operation

Steps:
1. Fragment the message
2. Compress (optional)
3. Compute and add MAC
4. Encrypt msg and MAC
5. Append SSL header
SSL Handshake Protocol
 Allows server & client to:
 authenticate each other
 to negotiate encryption & MAC algorithms
 to negotiate cryptographic keys to be used
 Comprises a series of messages in phases
1. Establish Security Capabilities
2. Server Authentication and Key Exchange
3. Client Authentication and Key Exchange
4. Finish
SSL Handshake Protocol
SSL Handshake Protocol
SSL Handshake
Protocol
 IPsec: Network Layer Security
 network-layer secrecy:
 for both AH and ESP,
 sending host encrypts the
data in IP datagram source, destination
 TCP and UDP segments; handshake:
 create network-layer
ICMP and SNMP
messages. logical channel called a
 network-layer authentication security association (SA)
 destination host can  each SA unidirectional.
authenticate source IP  uniquely determined by:
address  security protocol (AH or
 two principal protocols:
ESP)
 authentication header  source IP address
(AH) protocol  32-bit connection ID
 encapsulation security
payload (ESP) protocol

8: Network Security 8-26

IP Security (IPSec)
 various application security
mechanisms
 eg. S/MIME, PGP, Kerberos, SSL/HTTPS
 security concerns cross protocol layers
 hence would like security implemented
by the network for all applications
 authentication & encryption security
features included in next-generation
IPv6
 also usable in existing IPv4
IPSec
 general IP Security mechanisms
provides
 authentication
 confidentiality
 key management
 applicable to use over LANs, across
public & private WANs, & for the
Internet
IPsec
 IPsec (Internet Protocol Security) is a
protocol that provides security for IP-
based communication. IPsec can
operate in two modes: Tunnel Mode and
Transport Mode.

8: Network Security 8-29

Transport Mode:
 In Transport Mode, only the payload of
the IP packet is encrypted, not the
entire packet.
 This mode is used when a single host
needs to communicate with another
single host over a public network.
 In Transport Mode, only the data being
transmitted is encrypted, not the
header information such as the source
and destination addresses.
8: Network Security 8-30
Tunnel Mode:
 In Tunnel Mode, the entire original IP
packet is encapsulated in a new IP
packet. The new packet is then encrypted
and sent over the network.
 This mode is used when two entire
networks need to be connected over a
public network, such as the Internet.
 In Tunnel Mode, the entire IP packet,
including the original source and
destination addresses, is encrypted,
providing end-to-end security.
8-31
IPSec Uses
Benefits of IPSec
 when implemented in a firewall/router,
it provides strong security to all traffic
crossing the perimeter
 no overhead of security-related processing
 is below transport layer, hence
transparent to applications
 can be transparent to end users; no
need to train users on sec mechanisms
such as keys
 secures routing architecture
IP Security Architecture
 mandatory in IPv6, optional in IPv4
 have three main functions:
 AuthenticationHeader (AH): auth only
 Encapsulating Security Payload (ESP): auth &
encryption
 Key Exchange function: manual/auto exchange of
keys
 Example: VPNs want both auth and
encryption
 hence usually use ESP
 specification is quite complex
 numerous RFC’s 2401/2402/2406/2408
Security Associations (SA)
 a one-way relationship between sender
& receiver that affords security for
traffic flow
 defined by 3 parameters:
 Security Parameters Index (SPI): and index
in AH and ESP; tells receiver which SA to
select
 IP Destination Address: destination endpoint
of a SA
 Security Protocol Identifier

 has a number of other parameters

 seq no, AH & EH info, lifetime etc
Payload Protocols
 IPsec’s two main payload protocols: ESP
and AH
 AH (Authentication Header) — provides data
origin authentication, integrity, and anti-replay
for IP packets. AH does not encrypt payloads
(no confidentiality).
 ESP (Encapsulating Security Payload) —
provides confidentiality , and integrity,
authentication, and anti-replay. ESP is the
modern default for IPsec VPNs because it
provides encryption + authentication.

8: Network Security 8-36

Authentication Header (AH)
 provides support for data integrity &
authentication of IP packets
 end system/router can authenticate
user/app
 prevents address spoofing attacks by
tracking sequence numbers
 based on use of a MAC
 HMAC-MD5-96 or HMAC-SHA-1-96

 parties must share a secret key

 Authentication Header

Type of the header following this header; size of the AH; for future use;
SA; increasing seq counter; authentication data, e.g., MAC or
integrity check value
Authentication Header (AH) Protocol
 provides source AH header includes:
authentication, data  connection identifier
integrity, no confidentiality
  authentication data:
AH header inserted
between IP header, data source- signed message
field. digest calculated over
 protocol field: 51 original IP datagram.
 intermediate routers  next header field:
process datagrams as specifies type of data
usual
(e.g., TCP, UDP, ICMP)

IP header AH header data (e.g., TCP, UDP segment)

8: Network Security 8-39

ESP Protocol
 provides secrecy, host  ESP authentication
authentication, data field is similar to AH
integrity.
authentication field.
 data, ESP trailer encrypted.
 Protocol = 50.
 next header field is in ESP
trailer.

authenticated
encrypted
ESP ESP ESP
IP header TCP/UDP segment
header trailer authent
.

8: Network Security 8-40

Encapsulating Security
Payload (ESP)
8: Network Security 8-42