CSE543 Computer and Network Security Module: Network Security
|
|
|
- Louisa Cobb
- 6 years ago
- Views:
Transcription
1 CSE543 Computer and Network Security Module: Network Security Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1
2 2 Communication Security Want to establish a secure channel to remote hosts over an untrusted network Users - when logging in to a remote host Applications - when communicating across network Hosts - when logically part of the same network The protection service must Authenticate the end-points (each other) Negotiate what security is necessary (and how achieved) Establish a secure channel (e.g., key distribution/agreement) Process the traffic between the end points Also known as communications security.
3 3 Users Communications Security Login to a host over an untrusted network Using unauthenticated login - telnet, rsh - up to this point Problems How does user authenticate host? How does host authenticate user?
4 4 SSH Secure communication protocol Between user s client and remote machine (server) Used to implement remote login Runs on any transport layer (TCP/IP) Setup Authentication agent on client To produce and process messages on behalf of the user SSH Server To handle user logins to that host Forward X and TCP communications Remote machine use approximates local
5 SSH Protocol (1) Client opens connection to server (2) Server responds with its host key and server key Public keys identifying server and enabling communication (3) Client generates random number and encrypts with host and server keys (4) Server extracts random number (key) and can use Server is authenticated (5) Server authenticates user Password and RSA authentication (6) Preparatory phase To setup TCP/IP, X11 forwarding, etc. (7) Interactive session phase CSE543 - Introduction to Computer and Network Security 5
6 6 SSHv2 Protocol A number of improvements were made to the SSHv2 protocol (see Section 5) Flexible use of crypto - more algorithms Performance round trips on average Prevent eavesdropping - encrypt all SSH traffic Prevent IP spoofing - always validates server identity Prevent hijacking - integrity checking using HMAC Not backwards compatible with SSHv1
7 Application Comm Security Applications may want to construct secure communication channels transparently to users How can they do that? CSE543 - Introduction to Computer and Network Security 7
8 Application (Web) Security: SSL Secure socket Layer (SSL/TLS) Used to authenticate servers Uses certificates, root CAs Can authenticate clients HTTP Inclusive security protocol Security at the socket layer SSL Transport Layer Security (TLS) Provides authentication confidentiality integrity TCP IP CMPSC443 - Introduction to Computer and Network Security 8
9 SSL Handshake Client Server CMPSC443 - Introduction to Computer and Network Security 9
10 SSL Handshake (1) Client Hello (algorithms, ) Client Server CMPSC443 - Introduction to Computer and Network Security 9
11 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) Client Server CMPSC443 - Introduction to Computer and Network Security 9
12 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) (3) Server Certificate Client Server CMPSC443 - Introduction to Computer and Network Security 9
13 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) (3) Server Certificate Client Server CMPSC443 - Introduction to Computer and Network Security 9
14 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) (3) Server Certificate (4) ClientKeyRequest Client Server CMPSC443 - Introduction to Computer and Network Security 9
15 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) (3) Server Certificate (4) ClientKeyRequest Client (5) ChangeCipherSuite Server CMPSC443 - Introduction to Computer and Network Security 9
16 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) (3) Server Certificate (4) ClientKeyRequest Client (5) ChangeCipherSuite (6) ChangeCipherSuite Server CMPSC443 - Introduction to Computer and Network Security 9
17 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) (3) Server Certificate (4) ClientKeyRequest Client (5) ChangeCipherSuite (6) ChangeCipherSuite (7) Finished Server CMPSC443 - Introduction to Computer and Network Security 9
18 SSL Handshake (1) Client Hello (algorithms, ) (2) Server Hello (alg. selection, ) (3) Server Certificate (4) ClientKeyRequest Client (5) ChangeCipherSuite (6) ChangeCipherSuite (7) Finished (8) Finished Server CMPSC443 - Introduction to Computer and Network Security 9
19 Simplified Protocol Detail Participants: Alice/A (client) and Bob/B (server) Crypto Elements : Random R, Certificate C, k + i Public Key (of i) Crypto Functions : Hash function H(x), Encryption E(k, d), Decryption D(k, d), Keyed MAC HMAC(k, d) 1. Alice! Bob R A 2. Bob! Alice R B, C B Alice pick pre-master secret S Alice calculate master secret K = H(S, R A, R B ) 3. Alice! Bob E(k + B, S), HMAC(K,0 CLNT 0 + [#1, #2]) Bob recover pre-master secret S = D(k B, E(k + B, S)) Bob calculate master secret K = H(S, R A, R B ) 4. Bob! Alice HMAC(K, 0 SRV R 0 + [#1, #2]) Note: Alice and Bob : IV Keys, Encryption Keys, and Integrity Keys 6 keys,where each key k i = g i (K, R A, R B ), and g i is key generator function. CMPSC443 - Introduction to Computer and Network Security 10
20 SSL Tradeoffs Pros Server authentication* GUI clues for users Built into every browser Easy to configure on the server Protocol has been analyzed like crazy Cons Users don t check certificates Too easy to obtain certificates Too many roots in the browsers Some settings are terrible CMPSC443 - Introduction to Computer and Network Security 11
21 12 IPsec (not IPSec!) Host-level protection service IP-layer security (below TCP/UDP) De-facto standard for host level security Developed by the IETF (over many years) Available in most operating systems/devices E.g., XP, Vista, OS X, Linux, BSD*, Implements a wide range of protocols and cryptographic algorithms Selectively provides. Confidentiality, integrity, authenticity, replay protection, DOS protection
22 13 IPsec and the IP protocol stack IPsec puts the two main protocols in between IP and the other protocols HTTP TCP FTP SMTP UDP AH - authentication header ESP - encapsulating security payload AH IP ESP Other functions provided by external protocols and architectures
23 14 Modes of operation Transport : the payload is encrypted and the nonmutable fields are integrity verified (via MAC) MACed encrypted Header Payload Header Payload Tunnel : each packet is completely encapsulated (encrypted) in an outer IP packet Hides not only data, but some routing information MACed encrypted Header Payload Header Header Payload
24 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer
25 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer
26 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer
27 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
28 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
29 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
30 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
31 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
32 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
33 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
34 15 Tunneling IP over IP Network-level packets are encapsulated Allows traffic to avoid firewalls IP layer IP layer
35 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
36 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
37 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
38 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
39 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
40 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
41 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
42 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
43 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
44 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
45 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
46 16 IPsec: Packet Handling (Bump ) IP Protocol Stack Application Presentation Session Transport SADB IPsec Network (IP) Data Link Physical
47 Authentication Header (AH) Authenticity and integrity via HMAC over IP headers and data Advantage: the authenticity of data and IP header information is protected it gets a little complicated with mutable fields, which are supposed to be altered by network as packet traverses the network some fields are immutable, and are protected Confidentiality of data is not preserved Replay protection via AH sequence numbers note that this replicates some features of TCP (good?) CSE543 - Introduction to Computer and Network Security 17
48 18 Authentication Header (AH) Modifications to the packet format IP Header Payload IP Header AH Header MAC Payload AH Packet Authenticated Encrypted
49 19 Encapsulating Security Payload (ESP) Confidentiality, authenticity and integrity via encryption and HMAC over IP payload (data) Advantage: the security manipulations are done solely on user data TCP packet is fully secured simplifies processing Use null encryption to get authenticity/integrity only Note that the TCP ports are hidden when encrypted good: better security, less is known about traffic bad: impossible for FW to filter/traffic based on port
50 20 Encapsulating Security Payload (ESP) Modifications to packet format IP Header Payload IP Header ESP Header Payload ESP Trailer MAC ESP Packet Authenticated Encrypted
51 Practical Issues and Limitations IPsec implementations Large footprint resource poor devices are in trouble New standards to simplify (e.g, JFK, IKE2) Slow to adopt new technologies Configuration is really complicated/obscure Issues IPsec tries to be everything for everybody at all times Massive, complicated, and unwieldy Policy infrastructure has not emerged Large-scale management tools are limited (e.g., CISCO) Often not used securely (common pre-shared keys) CSE543 - Introduction to Computer and Network Security 21
52 22 Network Isolation: VPNs Idea: I want to create a collection of hosts that operate in a coordinated way E.g., a virtual security perimeter over physical network Hosts work as if they are isolated from malicious hosts Solution: Virtual Private Networks Create virtual network topology over physical network Use communications security protocol suites to secure virtual links tunneling Manage networks as if they are physically separate Hosts can route traffic to regular networks (split-tunneling)
53 23 VPN Example: RW/Telecommuter (network edge) Internet LAN Physical Link Logical Link (IPsec)
54 24 VPN Example: Hub and Spoke (network edge) Internet LAN Physical Link Logical Link (IPsec)
55 25 VPN Example: Mesh (network edge) Internet LAN Physical Link Logical Link (IPsec)
56 26 Virtual LANs (VLANs) VPNs built with hardware Physically wire VPN via soft configuration of a switch crossbar No encryption none needed wire based isolation Many switches support VLANs Allows networks to be reorganized without rewiring Example usage: two departments in same hallway Each office is associated with department Configuring the network switch gives physical isolation Note: often used to ensure QoS A B C D E A B C D E VLAN 1: A,B VLAN 2: C,D,E
CSE543 Computer and Network Security Module: Network Security
CSE543 Computer and Network Security Module: Network Security Professor Patrick McDaniel Fall 2009 1 Networking Fundamentally about transmitting information between two devices Direct communication is
CSE443 - Introduction to Computer and Network Security Network Security
CSE443 - Introduction to Computer and Network Security Network Security Professor Kevin Butler Winter 2011 Computer and Information Science Networking Fundamentally about transmitting information between
IPSec. Slides by Vitaly Shmatikov UT Austin. slide 1
IPSec Slides by Vitaly Shmatikov UT Austin slide 1 TCP/IP Example slide 2 IP Security Issues Eavesdropping Modification of packets in transit Identity spoofing (forged source IP addresses) Denial of service
Module: Network Security. Professor Patrick McDaniel Spring CMPSC443 - Introduction to Computer and Network Security
CMPSC443 - Introduction to Computer and Network Security Module: Network Security Professor Patrick McDaniel Spring 2009 1 Networking Fundamentally about transmitting information between users, applications,
Internet Security. - IPSec, SSL/TLS, SRTP - 29th. Oct Lee, Choongho
Internet Security - IPSec, SSL/TLS, SRTP - 29th. Oct. 2007 Lee, Choongho chlee@mmlab.snu.ac.kr Contents Introduction IPSec SSL / TLS SRTP Conclusion 2/27 Introduction (1/2) Security Goals Confidentiality
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP,
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls 32.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 32.2 Figure 32.1 Common structure
Protocol Architecture (2) Suguru Yamaguchi Nara Institute of Science and Technology Department of Information Science
Protocol Architecture (2) Suguru Yamaguchi Nara Institute of Science and Technology Department of Information Science History of computer network protocol development in 20 th century. Development of hierarchical
Transport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
IP Security IK2218/EP2120
IP Security IK2218/EP2120 Markus Hidell, mahidell@kth.se KTH School of ICT Based partly on material by Vitaly Shmatikov, Univ. of Texas Acknowledgements The presentation builds upon material from - Previous
Internet security and privacy
Internet security and privacy IPsec 1 Layer 3 App. TCP/UDP IP L2 L1 2 Operating system layers App. TCP/UDP IP L2 L1 User process Kernel process Interface specific Socket API Device driver 3 IPsec Create
Lecture 33. Firewalls. Firewall Locations in the Network. Castle and Moat Analogy. Firewall Types. Firewall: Illustration. Security April 15, 2005
Firewalls Lecture 33 Security April 15, 2005 Idea: separate local network from the Internet Trusted hosts and networks Intranet Firewall DMZ Router Demilitarized Zone: publicly accessible servers and networks
Network Encryption 3 4/20/17
The Network Layer Network Encryption 3 CSC362, Information Security most of the security mechanisms we have surveyed were developed for application- specific needs electronic mail: PGP, S/MIME client/server
Transport Layer Security
CEN585 Computer and Network Security Transport Layer Security Dr. Mostafa Dahshan Department of Computer Engineering College of Computer and Information Sciences King Saud University mdahshan@ksu.edu.sa
Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
IPSec. Overview. Overview. Levente Buttyán
IPSec - brief overview - security associations (SAs) - Authentication Header (AH) protocol - Encapsulated Security Payload () protocol - combining SAs (examples) Overview Overview IPSec is an Internet
Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München. ilab. Lab 8 SSL/TLS and IPSec
Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München ilab Lab 8 SSL/TLS and IPSec Outlook: On Layer 4: Goal: Provide security for one specific port SSL
Virtual Private Network
VPN and IPsec Virtual Private Network Creates a secure tunnel over a public network Client to firewall Router to router Firewall to firewall Uses the Internet as the public backbone to access a secure
CNT Computer and Network Security: BGP Security
CNT 5410 - Computer and Network Security: BGP Security Professor Kevin Butler Fall 2015 Internet inter-as routing: BGP BGP (Border Gateway Protocol): the de facto standard BGP provides each AS a means
Int ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
Network Security - ISA 656 IPsec IPsec Key Management (IKE)
Network Security - ISA 656 IPsec IPsec (IKE) Angelos Stavrou September 28, 2008 What is IPsec, and Why? What is IPsec, and Why? History IPsec Structure Packet Layout Header (AH) AH Layout Encapsulating
Introduction to IPsec. Charlie Kaufman
Introduction to IPsec Charlie Kaufman charliek@microsoft.com 1 IP Security (IPsec) IETF standard for Network Layer security Popular for creating trusted link (VPN), either firewall-firewall, or machine
IPsec (AH, ESP), IKE. Guevara Noubir CSG254: Network Security
IPsec (AH, ESP), IKE Guevara Noubir noubir@ccs.neu.edu Securing Networks Control/Management (configuration) Applications Layer telnet/ftp: ssh, http: https, mail: PGP (SSL/TLS) Transport Layer (TCP) (IPSec,
Chapter 6: Security of higher layers. (network security)
Chapter 6: Security of higher layers (network security) Outline TLS SET 1. TLS History of TLS SSL = Secure Socket Layer defined by Netscape normalized as TLS TLS = Transport Layer Security between TCP
CS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
The IPsec protocols. Overview
The IPsec protocols -- components and services -- modes of operation -- Security Associations -- Authenticated Header (AH) -- Encapsulated Security Payload () (c) Levente Buttyán (buttyan@crysys.hu) Overview
Secure channel, VPN and IPsec. stole some slides from Merike Kaeo
Secure channel, VPN and IPsec stole some slides from Merike Kaeo 1 HTTP and Secure Channel HTTP HTTP TLS TCP TCP IP IP 2 SSL and TLS SSL/TLS SSL v3.0 specified
Lecture 7 - Applied Cryptography
CSE497b Introduction to Computer and Network Security - Spring 2007 - Professor Jaeger Lecture 7 - Applied Cryptography CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger
CSC 4900 Computer Networks: Security Protocols (2)
CSC 4900 Computer Networks: Security Protocols (2) Professor Henry Carter Fall 2017 Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message Integrity 8.4 End point Authentication
Internet security and privacy
Internet security and privacy SSL/TLS 1 Application layer App. TCP/UDP IP L2 L1 2 Application layer App. SSL/TLS TCP/UDP IP L2 L1 3 History of SSL/TLS Originally, SSL Secure Socket Layer, was developed
Security Protocols. Professor Patrick McDaniel CSE545 - Advanced Network Security Spring CSE545 - Advanced Network Security - Professor McDaniel
Security Protocols Professor Patrick McDaniel CSE545 - Advanced Network Security Spring 2011 CSE545 - Advanced Network Security - Professor McDaniel 1 Case Study: Host Access The first systems used telnet
Advanced Security and Mobile Networks
WJ Buchanan. ASMN (1) Advanced Security and Mobile Networks Unit 1: Network Security Application Presentation Session Transport Network Data Link Physical OSI Application Transport Internet Internet model
Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder )
Application Note Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) This document describes how to configure McAfee Firewall Enterprise to provide
VPN World. MENOG 16 Istanbul-Turkey. By Ziad Zubidah Network Security Specialist
VPN World MENOG 16 Istanbul-Turkey By Ziad Zubidah Network Security Specialist What is this Van used for?! Armed Van It used in secure transporting for valuable goods from one place to another. It is bullet
Chapter 8 Network Security
Chapter 8 Network Security A note on the use of these ppt slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you can add, modify, and
HIP Host Identity Protocol. October 2007 Patrik Salmela Ericsson
HIP Host Identity Protocol October 2007 Patrik Salmela Ericsson Agenda What is the Host Identity Protocol (HIP) What does HIP try to solve HIP basics Architecture The HIP base exchange HIP basic features
Computer Security 3e. Dieter Gollmann. Security.di.unimi.it/sicurezza1415/ Chapter 16: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/sicurezza1415/ Chapter 16: 1 Chapter 16: Communications Security Chapter 16: 2 Agenda Threat model Secure tunnels Protocol design principles IPsec
INF3510 Information Security University of Oslo Spring Lecture 9 Communication Security. Audun Jøsang
INF3510 Information Security University of Oslo Spring 2011 Lecture 9 Communication Security Audun Jøsang Outline Network security concepts Communication security Perimeter security Protocol architecture
Cisco Exam Questions & Answers
Cisco 300-209 Exam Questions & Answers Number: 300-209 Passing Score: 800 Time Limit: 120 min File Version: 35.4 http://www.gratisexam.com/ Exam Code: 300-209 Exam Name: Implementing Cisco Secure Mobility
VPN, IPsec and TLS. stole slides from Merike Kaeo apricot2017 1
VPN, IPsec and TLS stole slides from Merike Kaeo apricot2017 1 Virtual Private Network Overlay Network a VPN is built on top of a public network (Internet)
Security Engineering. Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings)
Security Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings) Lecture Outline Network Attacks Attive Attacks Passive Attacks TCP Attacks Contermeasures IPSec SSL/TLS Firewalls
L13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
CSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Security in Network Layer Implementing security in application layer provides flexibility in security
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
IPsec and SSL/TLS. Applied Cryptography. Andreas Hülsing (Slides mostly by Ruben Niederhagen) Dec. 1st, /43
0/43 IPsec and SSL/TLS Applied Cryptography 0 Andreas Hülsing (Slides mostly by Ruben Niederhagen) Dec. 1st, 2016 Cryptography in the TCP/IP stack application layer transport layer network layer data-link
Application Layer. Presentation Layer. Session Layer. Transport Layer. Network Layer. Data Link Layer. Physical Layer
ISO/OSI Model SSL: Security at Transport Layer Application Layer Peer-to-peer Application Layer Network Security Assurance Presentation Layer Session Layer Transport Layer Presentation Layer Session Layer
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
HP Instant Support Enterprise Edition (ISEE) Security overview
HP Instant Support Enterprise Edition (ISEE) Security overview Advanced Configuration A.03.50 Mike Brandon Interex 03 / 30, 2004 2003 Hewlett-Packard Development Company, L.P. The information contained
On the Internet, nobody knows you re a dog.
On the Internet, nobody knows you re a dog. THREATS TO DISTRIBUTED APPLICATIONS 1 Jane Q. Public Big Bank client s How do I know I am connecting to my bank? server s Maybe an attacker...... sends you phishing
CIT 480: Securing Computer Systems
CIT 480: Securing Computer Systems Tunneling and VPNs CIT 480: Securing Computer Systems Slide #1 Topics 1. Tunneling 1. Encapsulation 2. Security 3. SSH 2. Virtual Private Networks 1. Site-to-site 2.
Network Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
IP Security. Have a range of application specific security mechanisms
IP Security IP Security Have a range of application specific security mechanisms eg. S/MIME, PGP, Kerberos, SSL/HTTPS However there are security concerns that cut across protocol layers Would like security
Chapter 4: Securing TCP connections
Managing and Securing Computer Networks Guy Leduc Chapter 5: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
Lecture Nov. 21 st 2006 Dan Wendlandt ISP D ISP B ISP C ISP A. Bob. Alice. Denial-of-Service. Password Cracking. Traffic.
15-441 Lecture Nov. 21 st 2006 Dan Wendlandt Worms & Viruses Phishing End-host impersonation Denial-of-Service Route Hijacks Traffic modification Spyware Trojan Horse Password Cracking IP Spoofing DNS
Creating VPN s with IPsec
2014 Creating VPN s with IPsec SPRING ENTERPRISE INFO SECURITY 4040/601 WILSON CHANCE HINCHMAN This paper will define the term VPN, explain for what and why VPNs are used. IPsec, which is vital to the
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 24a December 2, 2013 CPSC 467, Lecture 24a 1/20 Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management and Trusted
Secure Networking with NAT Traversal for Enhanced Mobility
Secure Networking with NAT Traversal for Enhanced Mobility Lubomir Cvrk 1, Vit Vrba 1 1 Brno University of Technology, Dept. of Telecommunications, Purkynova 118, 61200 Brno, Czech Republic {cvrk, vrba}@westcom.cz
IP Security. Cunsheng Ding HKUST, Kong Kong, China
IP Security Cunsheng Ding HKUST, Kong Kong, China Agenda Some attacks against the IP Brief introduction to IPSec Building Block: Security Association Building Block: Security Association Database Building
Sample excerpt. Virtual Private Networks. Contents
Contents Overview...................................................... 7-3.................................................... 7-5 Overview of...................................... 7-5 IPsec Headers...........................................
CIS 6930/4930 Computer and Network Security. Topic 8.1 IPsec
CIS 6930/4930 Computer and Network Security Topic 8.1 IPsec 1 IPsec Objectives Why do we need IPsec? IP V4 has no authentication IP spoofing Payload could be changed without detection. IP V4 has no confidentiality
COSC4377. Chapter 8 roadmap
Lecture 28 Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7
Lecture 9a: Secure Sockets Layer (SSL) March, 2004
Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Security Achieved by
Lecture 13 Page 1. Lecture 13 Page 3
IPsec Network Security: IPsec CS 239 Computer Software March 2, 2005 Until recently, the IP protocol had no standards for how to apply security Encryption and authentication layered on top Or provided
Virtual Private Networks (VPN)
CYBR 230 Jeff Shafer University of the Pacific Virtual Private Networks (VPN) 2 Schedule This Week Mon September 4 Labor Day No class! Wed September 6 VPN Project 1 Work Fri September 8 IPv6? Project 1
PROGRAMMING Kyriacou E. Frederick University Cyprus. Network communication examples
ACSC424 NETWORK APPLICATION PROGRAMMING Kyriacou E. Frederick University Cyprus communication examples The OSI reference model (proposed by ISO) Application A Application B 2 Application Application Presentation
Chapter 5: Network Layer Security
Managing and Securing Computer Networks Guy Leduc Mainly based on Network Security - PRIVATE Communication in a PUBLIC World C. Kaufman, R. Pearlman, M. Speciner Pearson Education, 2002. (chapters 17 and
Lecture 10: Communications Security
INF3510 Information Security Lecture 10: Communications Security Nils Gruschka University of Oslo Spring 2018 Introduction Nils Gruschka University Kiel (Diploma in Computer Science) T-Systems, Hamburg
E-commerce security: SSL/TLS, SET and others. 4.1
E-commerce security: SSL/TLS, SET and others. 4.1 1 Electronic payment systems Purpose: facilitate the safe and secure transfer of monetary value electronically between multiple parties Participating parties:
Introduction and Overview. Why CSCI 454/554?
Introduction and Overview CSCI 454/554 Why CSCI 454/554? Get Credits and Graduate Security is important More job opportunities More research funds 1 Workload Five homework assignments Two exams (open book
CSC 6575: Internet Security Fall 2017
CSC 6575: Internet Security Fall 2017 Network Security Devices IP Security Mohammad Ashiqur Rahman Department of Computer Science College of Engineering Tennessee Tech University 2 IPSec Agenda Architecture
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 15 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear,
Introduction. INF3510 Information Security. Lecture 10: Communications Security. Outline. Network Security Concepts. University of Oslo Spring 2018
Introduction INF3510 Information Security Lecture 10: Communications Security Nils Gruschka University of Oslo Spring 2018 Nils Gruschka University Kiel (Diploma in Computer Science) T-Systems, Hamburg
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Network Security: IPsec. Tuomas Aura
Network Security: IPsec Tuomas Aura 3 IPsec architecture and protocols Internet protocol security (IPsec) Network-layer security protocol Protects IP packets between two hosts or gateways Transparent to
INDEX. Symbols. 3DES over4 mechanism to4 mechanism...101
INDEX Symbols 3DES...138 6over4 mechanism...101 6to4 mechanism...101 A AA...24 AAAA...99 access control list. See ACL ACK...150 ACK-SYN message...150 ACL...110 ActiveX...38 Active attacks...196 Active
Chapter 11 The IPSec Security Architecture for the Internet Protocol
Chapter 11 The IPSec Security Architecture for the Internet Protocol IPSec Architecture Security Associations AH / ESP IKE [NetSec], WS 2008/2009 11.1 The TCP/IP Protocol Suite Application Protocol Internet
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ Chapter 8 Network Security Computer Networking: A Top Down Approach, 5 th edition. Jim Kurose, Keith Ross Addison-Wesley, April 2009.
Numerics I N D E X. 3DES (Triple Data Encryption Standard), 48
I N D E X Numerics A 3DES (Triple Data Encryption Standard), 48 Access Rights screen (VPN 3000 Series Concentrator), administration, 316 322 Action options, applying to filter rules, 273 adding filter
Administrator's Guide
Administrator's Guide Contents Administrator's Guide... 7 Using Web Config Network Configuration Software... 8 About Web Config... 8 Accessing Web Config... 8 Changing the Administrator Password in Web
VPN Ports and LAN-to-LAN Tunnels
CHAPTER 6 A VPN port is a virtual port which handles tunneled traffic. Tunnels are virtual point-to-point connections through a public network such as the Internet. All packets sent through a VPN tunnel
Junos Security. Chapter 8: IPsec VPNs Juniper Networks, Inc. All rights reserved. Worldwide Education Services
Junos Security Chapter 8: IPsec VPNs 2012 Juniper Networks, Inc. All rights reserved. www.juniper.net Worldwide Education Services Chapter Objectives After successfully completing this chapter, you will
David Wetherall, with some slides from Radia Perlman s security lectures.
David Wetherall, with some slides from Radia Perlman s security lectures. djw@cs.washington.edu Networks are shared: Want to secure communication between legitimate participants from others with (passive
Cisco Exam Implementing Cisco Network Security Version: 12.0 [ Total Questions: 186 ]
![Cisco Exam Implementing Cisco Network Security Version: 12.0 [ Total Questions: 186 ]](/thumbs/79/80167168.jpg "Cisco Exam Implementing Cisco Network Security Version: 12.0 [ Total Questions: 186 ]")
s@lm@n Cisco Exam 210-260 Implementing Cisco Network Security Version: 12.0 [ Total Questions: 186 ] Cisco 210-260 : Practice Test Question No : 1 When an IPS detects an attack, which action can the IPS
14. Internet Security (J. Kurose)
14. Internet Security (J. Kurose) 1 Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application layer:
Distributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
Administrator's Guide
Administrator's Guide Contents Administrator's Guide... 7 Using Web Config Network Configuration Software... 8 About Web Config... 8 Accessing Web Config... 8 Changing the Administrator Password in Web
AIT 682: Network and Systems Security
AIT 682: Network and Systems Security Final Exam Review Instructor: Dr. Kun Sun Topics covered by Final Topic before Midterm 10% Topic after Midterm 90% Date: 12/13/2017 7:30am 10:15am Place: the same
Cryptography SSL/TLS. Network Security Workshop. 3-5 October 2017 Port Moresby, Papua New Guinea
Cryptography SSL/TLS Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea 1 History Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent
Fundamentals of Linux Platform Security
Fundamentals of Linux Platform Security Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Linux Platform Security Module 9 Application Security Roadmap ssh SSL IPsec & VPNs
The IPSec Security Architecture for the Internet Protocol
Chapter 11 The IPSec Security Architecture for the Internet Protocol [NetSec], WS 2005/2006 11.1 Overview Brief introduction to the Internet Protocol (IP) suite Security problems of IP and objectives of
VPN and IPsec. Network Administration Using Linux. Virtual Private Network and IPSec 04/2009
VPN and IPsec Network Administration Using Linux Virtual Private Network and IPSec 04/2009 What is VPN? VPN is an emulation of a private Wide Area Network (WAN) using shared or public IP facilities. A
Cryptography and secure channel. May 17, Networks and Security. Thibault Debatty. Outline. Cryptography. Public-key encryption
and secure channel May 17, 2018 1 / 45 1 2 3 4 5 2 / 45 Introduction Simplified model for and decryption key decryption key plain text X KE algorithm KD Y = E(KE, X ) decryption ciphertext algorithm X
Computer Security. 12. Firewalls & VPNs. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 12. Firewalls & VPNs Paul Krzyzanowski Rutgers University Spring 2018 April 15, 2018 CS 419 2018 Paul Krzyzanowski 1 Conversation Isolation: Network Layer Virtual Private Networks (VPNs)
The Internet community has developed application-specific security mechanisms in a number of application areas, including electronic mail (S/MIME,
1 The Internet community has developed application-specific security mechanisms in a number of application areas, including electronic mail (S/MIME, PGP), client/server (Kerberos), Web access (Secure Sockets
Configuration of an IPSec VPN Server on RV130 and RV130W
Configuration of an IPSec VPN Server on RV130 and RV130W Objective IPSec VPN (Virtual Private Network) enables you to securely obtain remote access to corporate resources by establishing an encrypted tunnel
SSL/TLS & 3D Secure. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk SSL/TLS & 3DSec 1
SSL/TLS & 3D Secure CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk SSL/TLS & 3DSec 1 SSLv2 Brief History of SSL/TLS Released in 1995 with Netscape 1.1 Key generation algorithm
REMOTE ACCESS IPSEC. Course /14/2014 Global Technology Associates, Inc.
REMOTE ACCESS IPSEC Course 4002 1 Remote Access Features! Granular Network Access and Authorization based on groups and policies.! Windows, Linux, and MAC client support. Windows ShrewSoft Client MAC IPSecuritas
Cryptography (Overview)
Cryptography (Overview) Some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) Modern secret key cryptography DES, AES Public key cryptography RSA, digital signatures Cryptography
Sharing IPsec with Tunnel Protection
The feature allows sharing an IPsec security association database (SADB) between two or more generic routing encapsulation (GRE) tunnel interfaces when tunnel protection is used. Shared tunnel interfaces