Introduction to Network Security Missouri S&T University CPE 5420 Network Access Control

Transcription

1 Introduction to Network Security Missouri S&T University CPE 5420 Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology 28 October 2016 rev Egemen K. Çetinkaya

2 Overview Methods Outline 28 October 2016 MST CPE

3 Overview Methods Overview 28 October 2016 MST CPE

4 Overview NAC Deals with authorized access Authenticates users Decides what action a user can perform 28 October 2016 MST CPE

5 Architecture Egemen K. Çetinkaya 28 October 2016 MST CPE

6 Architectural Components Users/supplicants/access requestors Policy servers Network authentication server/media gateway policy server can be part of NAS 28 October 2016 MST CPE

7 Overview Methods Methods 28 October 2016 MST CPE

8 IEEE 802.1X Methods port-based network access control VLAN virtual local area network Firewall ACL access control list 28 October 2016 MST CPE

9 IEEE 802.1X Overview Port-based network access control port: IEEE 802 LAN service access points Protocols for secure communication between devices Provides: authentication, authorization, key agreement It defines EAP over LAN protocol (EAPOL) EAP extensible authentication protocol [RFC 3748] History: version incorporates applications of 801.1AE MACsec MACsec provides confidentiality of the MAC frames 28 October 2016 MST CPE

10 IEEE 802.1X Authentication Example Standards are linked on the webpage [Ref: 28 October 2016 MST CPE

11 VLAN Overview Virtual local area network Partition the layer-2 network into broadcast domains End nodes may not be on the same physical location 28 October 2016 MST CPE

12 VLAN Example Traffic cannot pass between VLANs [Ref: CISCO VLAN] 28 October 2016 MST CPE

13 Firewall Overview Firewalls are defense mechanisms Allows authorized traffic to pass through firewall A firewall can serve as a platform for IPsec in tunnel mode VPN acts like a firewall Types of firewalls packet filtering based on packet type, port number, address number etc. stateful inspection in addition to packet filtering looks for TCP characteristics application layer filtering filtering based on applications (e.g. , FTP, HTTP) 28 October 2016 MST CPE

14 Packet Filtering Example Packet filtering rules applied in the order Rule Source Address Destination Address Action permit / /0 deny Rule # 2 is considered default rule: what happens to packet none other rule applies? 28 October 2016 MST CPE

15 Packet Filtering Examples Egemen K. Çetinkaya permit TCP src >= 1024 dst = 25 permit UDP src > 910 dst = 53 deny ICMP type = 8 [Ref: Cisco IP filtering] 28 October 2016 MST CPE

16 Packet Filtering Examples Egemen K. Çetinkaya permit TCP src >= 1024 dst = 25 allows TCP segments with a source port >= 1024 and a destination port of 25 (SMTP mail) permit UDP src > 910 dst = 53 allow UDP segments with a source port > 910 and a destination port of 53 (Domain Name Service) deny ICMP type = 8 deny ICMP echo request (pings) [Ref: Cisco IP filtering] 28 October 2016 MST CPE

17 Firewall Caveats Why firewalls don t work? Egemen K. Çetinkaya 28 October 2016 MST CPE

18 Firewall Caveats Why firewalls don t work? Good for defense against outsiders, but not insiders Insider may be tricked into downloading: malicious code/ /virus Misconfigured firewall can be annoying 28 October 2016 MST CPE

19 Access control list ACL Overview A mechanism for access to system resource List of permissions filesystem ACL e.g. for access to which files by whom in an end-host network ACL e.g. rules applied for packet filtering Similar to firewall firewalls can do stateful inspection can keep track of TCP states in the state machine ACLs are stateless 28 October 2016 MST CPE

20 References and Further Reading [KPS2002] Charlie Kaufman, Radia Perlman, and Mike Speciner, Network Security: Private Communication in a Public World, 2nd edition, Prentice Hall, [S2017] William Stallings, Cryptography and Network Security: Principles and Practice, 7th edition, Prentice Hall, [NAT: RFC 3022, RFC 2663] [L2TP: RFC 2661, RFC 3193] 28 October 2016 MST CPE

21 End of Foils 28 October 2016 MST CPE