UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
Upload
Sign in
Uploaded byPriyadharshiniVS
PPTX, PDF260 views

Cryptography and network security

IP Security (IPsec) is a suite of protocols designed to provide data authentication, integrity, and confidentiality across IP networks. It utilizes components such as the Encapsulating Security Payload (ESP) for encryption, the Authentication Header (AH) for integrity, and the Internet Key Exchange (IKE) for secure key management. IPsec can secure communication by encrypting data, authenticating senders, and establishing secure tunnels, commonly used in Virtual Private Networks (VPNs).

Educationā—¦
Download to read offline
1 / 19
2 / 19
3 / 19
4 / 19
5 / 19
6 / 19
7 / 19
8 / 19
9 / 19
10 / 19
11 / 19
12 / 19
13 / 19
14 / 19
15 / 19
16 / 19
17 / 19
18 / 19
19 / 19
1 NADAR SARASWATHI COLLEGE OF ARTS&SCIENCE,THENI DEPARTMENT OF COMPUTER SCIENCE&INFORMATION TECHNOLOGY V.S.PRIYADHARSHINI I MSC(CS)
2 TOPIC: IP SECURITY
IP security (IPSec) ā€¢ The IP security (IPSec) is an Internet Engineering Task Force (IETF) standard suite of protocols between 2 communication points across the IP network that provide data authentication, integrity, and confidentiality. It also defines the encrypted, decrypted and authenticated packets. The protocols needed for secure key exchange and key management are defined in it. 3
Uses of IP Security ā€“ ā€¢ IPsec can be used to do the following things: ā€¢ To encrypt application layer data. ā€¢ To provide security for routers sending routing data across the public internet. ā€¢ To provide authentication without encryption, like to authenticate that the data originates from a known sender. ā€¢ To protect network data by setting up circuits using IPsec tunneling in which all data is being sent between the two endpoints is encrypted, as with a Virtual Private Network(VPN) connection. 4
ā€¢ Components of IP Security It has the following components: ā€¢ Encapsulating Security Payload (ESP) ā€¢ Authentication Header (AH) ā€¢ Internet Key Exchange (IKE) 5
ā€¢ Components of IP Security ā€“ It has the following components: ā€¢ Encapsulating Security Payload (ESP) ā€“ It provides data integrity, encryption, authentication and anti replay. It also provides authentication for payload. ā€¢ Authentication Header (AH) ā€“ It also provides data integrity, authentication and anti replay and it does not provide encryption. The anti replay protection, protects against unauthorized transmission of packets. It does not protect dataā€™s confidentiality. 6
7 ā€¢Internet Key Exchange (IKE) ā€“ It is a network security protocol designed to dynamically exchange encryption keys and find a way over Security Association (SA) between 2 devices. The Security Association (SA) establishes shared security attributes between 2 network entities to support secure communication. The Key Management Protocol (ISAKMP) and Internet Security Association which provides a framework for authentication and key exchange. ISAKMP tells how the set up of the Security Associations (SAs) and how direct connections between two hosts that are using IPsec.
ā€¢ Internet Key Exchange (IKE) provides message content protection and also an open frame for implementing standard algorithms such as SHA and MD5. The algorithmā€™s IP sec users produces a unique identifier for each packet. This identifier then allows a device to determine whether a packet has been correct or not. Packets which are not authorized are discarded and not given to receiver. 8
Working of IP Security ā€¢ The host checks if the packet should be transmitted using IPsec or not. These packet traffic triggers the security policy for themselves. This is done when the system sending the packet apply an appropriate encryption. The incoming packets are also checked by the host that they are encrypted properly or not. ā€¢ Then the IKE Phase 1 starts in which the 2 hosts( using IPsec ) authenticate themselves to each other to start a secure channel. It has 2 modes. The Main mode which provides the greater security and the Aggressive mode which enables the host to establish an IPsec circuit more quickly. 9
ā€¢ The channel created in the last step is then used to securely negotiate the way the IP circuit will encrypt data across the IP circuit. ā€¢ Now, the IKE Phase 2 is conducted over the secure channel in which the two hosts negotiate the type of cryptographic algorithms to use on the session and agreeing on secret keying material to be used with those algorithms. ā€¢ Then the data is exchanged across the newly created IPsec encrypted tunnel. These packets are encrypted and decrypted by the hosts using IPsec SAs. ā€¢ When the communication between the hosts is completed or the session times out then the IPsec tunnel is terminated by discarding the keys by both the hosts. 10
IPSec Architecture ā€¢ IPSec (IP Security) architecture uses two protocols to secure the traffic or data flow. These protocols are ESP (Encapsulation Security Payload) and AH (Authentication Header). IPSec Architecture include protocols, algorithms, DOI, and Key Management. All these components are very important in order to provide the three main services: ā€¢ Confidentiality ā€¢ Authentication ā€¢ Integrity 11
12
ā€¢ 1. Architecture: Architecture or IP Security Architecture covers the general concepts, definitions, protocols, algorithms and security requirements of IP Security technology. ā€¢ 2. ESP Protocol: ESP(Encapsulation Security Payload) provide the confidentiality service. Encapsulation Security Payload is implemented in either two ways: ā€¢ ESP with optional Authentication. ā€¢ ESP with Authentication. 13
Packet format 14
ā€¢ Security Parameter Index(SPI): This parameter is used in Security Association. It is used to give a unique number to the connection build between Client and Server. ā€¢ Sequence Number: Unique Sequence number are allotted to every packet so that at the receiver side packets can be arranged properly. ā€¢ Payload Data: Payload data means the actual data or the actual message. The Payload data is in encrypted format to achieve confidentiality. 15
ā€¢ Padding: Extra bits or space added to the original message in order to ensure confidentiality. Padding length is the size of the added bits or space in the original message. ā€¢ Next Header: Next header means the next payload or next actual data. ā€¢ Authentication Data This field is optional in ESP protocol packet format. 16
ā€¢ 3. Encryption algorithm: Encryption algorithm is the document that describes various encryption algorithm used for Encapsulation Security Payload. ā€¢ 4. AH Protocol: AH (Authentication Header) Protocol provides both Authentication and Integrity service. Authentication Header is implemented in one way only: Authentication along with Integrity. 17
ā€¢ Authentication Header covers the packet format and general issue related to the use of AH for packet authentication and integrity. ā€¢ 5. Authentication Algorithm: Authentication Algorithm contains the set of the documents that describe authentication algorithm used for AH and for the authentication option of ESP. ā€¢ 6. DOI (Domain of Interpretation): DOI is the identifier which support both AH and ESP protocols. It contains values needed for documentation related to each other. ā€¢ 7. Key Management: Key Management contains the document that describes how the keys are exchanged between sender and receiver. 18
19