Application Layer. Presentation Layer. Session Layer. Transport Layer. Network Layer. Data Link Layer. Physical Layer
|
|
- Victor Shields
- 6 years ago
- Views:
Transcription
1 ISO/OSI Model SSL: Security at Transport Layer Application Layer Peer-to-peer Application Layer Network Security Assurance Presentation Layer Session Layer Transport Layer Presentation Layer Session Layer Transport Layer Lecture 9 Network Layer Data Link Layer Network Layer Data Link Layer Network Layer Data Link Layer October 30, 2003 Physical Layer Physical Layer Flow of bits Physical Layer Courtesy of Professors Chris Clifton & Matt Bishop INFSCI 2935: Introduction of Computer Security 1 INFSCI 2935: Introduction to Computer Security 2 1
2 Security at the Transport Layer Secure Socket Layer (SSL) Developed by Netscape to provide security in WWW browsers and servers SSL is the basis for the Internet standard protocol Transport Layer Security (TLS) protocol (compatible with SSLv3) Key idea: Connections and Sessions A SSL session is an association between two peers An SSL connection is the set of mechanisms used to transport data in an SSL session Secure Socket Layer (SSL) Each party keeps session information Session identifier (unique) The peer s X.503(v3) certificate Compression method used to reduce volume of data Cipher specification (parameters for cipher and MAC) Master secret of 48 bits Connection information Random data for the server & client Server and client keys (used for encryption) Server and client MAC key Initialization vector for the cipher, if needed Server and client sequence numbers Provides a set of supported cryptographic mechanisms that are setup during negotiation (handshake protocol) INFSCI 2935: Introduction to Computer Security 3 INFSCI 2935: Introduction to Computer Security 4 2
3 SSL Architecture SSL Record Protocol Operation e.g., HTTP messages Provides a basis for Secure communication Confidentiality + Message authenticity Message type, version, length of block INFSCI 2935: Introduction to Computer Security 5 INFSCI 2935: Introduction to Computer Security 6 3
4 Handshake Protocol The most complex part of SSL Allows the server and client to authenticate each other Based on interchange cryptosystem (e.g., RSA) Negotiate encryption, MAC algorithm and cryptographic keys Four rounds Used before any application data are transmitted Other protocols SSL Change Cipher Spec Protocol A single byte is exchanged After new cipher parameters have been negotiated (renegotiated) SSL Alert Protocol Signals an unusual condition Closure alert : sender will not send anymore Error alert: fatal error results in disconnect INFSCI 2935: Introduction to Computer Security 7 INFSCI 2935: Introduction to Computer Security 8 4
5 ISO/OSI Model IPSec: Security at Network Layer IPSec Application Layer Presentation Layer Session Layer Transport Layer Network Layer Data Link Layer Physical Layer Peer-to-peer Network Layer Data Link Layer Physical Layer Flow of bits Application Layer Presentation Layer Session Layer Transport Layer Network Layer Data Link Layer Physical Layer Set of protocols/mechanisms Encrypts and authenticates all traffic at the IP level Protects all messages sent along a path Intermediate host with IPSec mechanism (firewall, gateway) is called a security gateway Use on LANs, WANs, public, and private networks Application independent (Transparent to user) Web browsing, telnet, ftp Provides at the IP level Access control Connectionless integrity Data origin authentication Rejection of replayed packets Data confidentiality Limited traffic analysis confidentiality INFSCI 2935: Introduction to Computer Security 9 INFSCI 2935: Introduction to Computer Security 10 5
6 Cases where IPSec can be used Cases where IPSec can be used (2) Internet/ Intranet Intranet SG Internet SG Intranet End-to-end security between two hosts End-to-end security between two hosts + two gateways SG Internet/ Intranet SG Internet SG Intranet End-to-end security between two security gateways INFSCI 2935: Introduction to Computer Security 11 End-to-end security between two hosts during dial-up INFSCI 2935: Introduction to Computer Security 12 6
7 IPSec Protocols Security Association (SA) Authentication header (AH) protocol Message integrity Origin authentication Anti-replay services Encapsulating security payload (ESP) protocol Confidentiality Message integrity Origin authentication Anti-replay services Internet Key Exchange (IKE) Exchanging keys between entities that need to communicate over the Internet What authentication methods to use, how long to use the keys, etc. Unidirectional relationship between peers (a sender and a receiver) Specifies the security services provided to the traffic carried on the SA Security enhancements to a channel along a path Identified by three parameters: IP Destination Address Security Protocol Identifier Specifies whether AH or ESP is being used Security Parameters Index (SPI) Specifies the security parameters associated with the SA INFSCI 2935: Introduction to Computer Security 13 INFSCI 2935: Introduction to Computer Security 14 7
8 Security Association (2) Each SA uses AH or ESP (not both) If both required two are SAs are created Multiple security associations may be used to provide required security services A sequence of security associations is called SA bundle Example: We can have an AH protocol followed by ESP or vice versa INFSCI 2935: Introduction to Computer Security 15 Security Association Databases IP needs to know the SAs that exist in order to provide security services Security Policy Database (SPD) IPSec uses SPD to handle messages For each IP packet, it decides whether an IPSec service is provided, bypassed, or if the packet is to be discarded Security Association Database (SAD) Keeps track of the sequence number AH information (keys, algorithms, lifetimes) ESP information (keys, IVs, algorithms, lifetimes) Lifetime of the SA Protocol mode MTU INFSCI 2935: Introduction to Computer Security 16 8
9 IPSec Modes Authentication (AH) Two modes Transport mode Encapsulates IP packet data area IP is not protected Protection is provided for the upper layers Usually used in host-to-host communications Tunnel mode Encapsulates entire IP packet in an IPSec envelope Helps against traffic analysis The original IP packet is untouched in the Internet Next header Identifies what protocol header follows Payload length Indicates the number of 32-bit words in the authentication header Security Parameters Index Specifies to the receiver the algorithms, type of keys, and lifetime of the keys used Sequence number Counter that increases with each IP packet sent from the same host to the same destination and SA Authentication Data parameters Next Payload length Security Parameters Index Sequence Number Authentication Data INFSCI 2935: Introduction to Computer Security 17 INFSCI 2935: Introduction to Computer Security 18 9
10 Preventing replay Transport Mode AH Using 32 bit sequence numbers helps detect replay of IP packets The sender initializes a sequence number for every SA Each succeeding IP packet within a SA increments the sequence number Receiver implements a window size of W to keep track of authenticated packets Receiver checks the MAC to see if the packet is authentic INFSCI 2935: Introduction to Computer Security 19 Original IP Original IP Next TCP Auth Payload Length Internet/ Intranet TCP SPI Payload Data Seq. No. Payload Data MAC Without IPSec INFSCI 2935: Introduction to Computer Security 20 10
11 Tunnel Mode AH Original IP New IP Next Payload Length Internet TCP Auth Original IP SPI SG Payload Data Seq. No. TCP MAC Intranet Without IPSec Payload Data INFSCI 2935: Introduction to Computer Security 21 ESP Encapsulating Security Payload Creates a new header in addition to the IP header Creates a new trailer Encrypts the payload data Authenticates the security association Prevents replay Security Parameters Index (SPI) 32 bits Sequence Number 32 bits Payload Data Padding/ Next Authentication Data INFSCI 2935: Introduction to Computer Security 22 11
12 Details of ESP Transport mode ESP Security Parameters Index (SPI) Specifies to the receiver the algorithms, type of keys, and lifetime of the keys used Sequence number Counter that increases with each IP packet sent from the same host to the same destination and SA Payload Application data carried in the TCP segment Padding 0 to 255 bytes of data to enable encryption algorithms to operate properly To mislead sniffers from estimating the amount of data transmitted Authentication Data MAC created over the packet Original IP Original IP TCP ESP TCP Payload Data Encrypted Payload Data Authenticated Without IPSec ESP Trailer ESP Auth INFSCI 2935: Introduction to Computer Security 23 INFSCI 2935: Introduction to Computer Security 24 12
13 Tunnel mode ESP Perimeter Defense New IP Original IP ESP TCP Original IP Payload Data TCP Encrypted Authenticated Payload Data Without IPSec ESP Trailer ESP Auth Organization system consists of a network of many host machines the system is as secure as the weakest link Use perimeter defense Define a border and use gatekeeper (firewall) If host machines are scattered and need to use public network, use encryption Virtual Private Networks (VPNs) INFSCI 2935: Introduction to Computer Security 25 INFSCI 2935: Introduction to Computer Security 26 13
14 Perimeter Defense Is it adequate? Locating and securing all perimeter points is quite difficult Less effective for large border Inspecting/ensuring that remote connections are adequately protected is difficult Insiders attack is often the most damaging Firewalls Total isolation of networked systems is undesirable Use firewalls to achieve selective border control Firewall Is a configuration of machines and software Limits network access Come for free inside many devices: routers, modems, wireless base stations etc. Alternate: a firewall is a host that mediates access to a network, allowing and disallowing certain type of access based on a configured security policy INFSCI 2935: Introduction to Computer Security 27 INFSCI 2935: Introduction to Computer Security 28 14
15 What Firewalls can t do They are not a panacea Only adds to defense in depth If not managed properly Can provide false sense of security Cannot prevent insider attack Firewalls act a particular layer (or layers) Virtual Private Networks What is it? It is a private network that is configured within a public network A A VPN appears to be a private national or international network to a customer The customer is actually sharing trunks and other physical infrastructure with other customers Security? INFSCI 2935: Introduction to Computer Security 29 INFSCI 2935: Introduction to Computer Security 30 15
16 What is a VPN? (2) Secure IP VPNs A network that supports a closed community of authorized users The authorized users are allowed to access various network related resources and services There is traffic isolation Contents are secure Services and resources are secure Use the public Internet as part of the virtual private network Provide security! Confidentiality and integrity of data User authentication Network access control IPSec Use the public Internet as part of the virtual private network Provide security! Confidentiality and integrity of data User authentication Network access control IPSec can be used INFSCI 2935: Introduction to Computer Security 31 INFSCI 2935: Introduction to Computer Security 32 16
17 Tunneling in VPN Typical corporate network Intranet Firewall Mail forwarding Demilitarized Zone (DMZ) File Server Web Server Web Server DNS (DMZ) Mail server DNS (internal) Firewall INFSCI 2935: Introduction to Computer Security 33 User machines User machines User machines Internet INFSCI 2935: Introduction to Computer Security 34 17
18 Typical network: Terms Network Regions Internet Intranet DMZ Network Boundaries Firewall Filtering firewall: Based on packet headers Audit mechanism Proxy Proxy firewall: Gives external view that hides intranet Contents of packets and messages besides attributes of packet headers INFSCI 2935: Introduction to Computer Security 35 Issues IP: Intranet hidden from outside world Internal addresses can be real Proxy maps between real address and firewall Fake private addresses Network Address Translation protocol maps internal addresses to the Internet addresses (inner firewall) Mail Forwarding Mail Forwarding Hide internal addresses Map incoming mail to real server Additional incoming/outgoing checks INFSCI 2935: Introduction to Computer Security 36 18
19 Firewalls: Configuration External Firewall What traffic allowed External source: IP restrictions What type of traffic: Ports (e.g., SMTP, HTTP) Proxy between DMZ servers and internet Internal Firewall Traffic restrictions: Ports, From/to IP Proxy between intranet and outside DMZ Administration Direct console access required? Real hassle Special access SSH connections allowed from internal to DMZ administration connections Only from specified internal IPs Only through internal firewall INFSCI 2935: Introduction to Computer Security 37 INFSCI 2935: Introduction to Computer Security 38 19
20 Overview Assurance Trust Problems from lack of assurance Types of assurance Life cycle and assurance Waterfall life cycle model Other life cycle models Courtesy of Professors Chris Clifton & Matt Bishop INFSCI 2935: Introduction of Computer Security 39 INFSCI 2935: Introduction to Computer Security 40 20
21 Trust Relationships Trustworthy entity has sufficient credible evidence leading one to believe that the system will meet a set of requirements Trust is a measure of trustworthiness relying on the evidence Assurance is confidence that an entity meets its security requirements based on evidence provided by the application of assurance techniques Formal methods, design analysis, testing etc. INFSCI 2935: Introduction to Computer Security 41 Policy Assurance Mechanisms Statement of requirements that explicitly defines the security expectations of the mechanism(s) Provides justification that the mechanism meets policy through assurance evidence and approvals based on evidence Executable entities that are designed and implemented to meet the requirements of the policy Evaluation standards Trusted Computer System Evaluation Criteria Information Technology Security Evaluation Criteria Common Criteria INFSCI 2935: Introduction to Computer Security 42 21
22 Problem Sources (Neumann) Examples 1. Requirements definitions, omissions, and mistakes 2. System design flaws 3. Hardware implementation flaws, such as wiring and chip flaws 4. Software implementation errors, program bugs, and compiler bugs 5. System use and operation errors and inadvertent mistakes 6. Willful system misuse 7. Hardware, communication, or other equipment malfunction 8. Environmental problems, natural causes, and acts of God 9. Evolution, maintenance, faulty upgrades, and decommissions INFSCI 2935: Introduction to Computer Security 43 Challenger explosion (1986) Sensors removed from booster rockets to meet accelerated launch schedule Deaths from faulty radiation therapy system Hardware safety interlock removed Flaws in software design Bell V22 Osprey crashes Failure to correct for malfunctioning components; two faulty ones could outvote a third Intel 486 chip bug (trigonometric function) Cost a lot of time and money INFSCI 2935: Introduction to Computer Security 44 22
23 Role of Requirements Requirements are statements of goals that must be met Vary from high-level, generic issues to lowlevel, concrete issues Security objectives are high-level security issues and business goals Security requirements are specific, concrete issues Types of Assurance Policy assurance is evidence establishing security requirements in policy is complete, consistent, technically sound To counter threats and meet objectives Design assurance is evidence establishing design sufficient to meet requirements of security policy Implementation assurance is evidence establishing implementation consistent with security requirements of security policy Need to use good engineering practices INFSCI 2935: Introduction to Computer Security 45 INFSCI 2935: Introduction to Computer Security 46 23
24 Types of Assurance Assurance steps Operational assurance is evidence establishing system sustains the security policy requirements during installation, configuration, and day-to-day operation Also called administrative assurance Example, Do a thorough review of product or system documentation and procedures, to ensure that the system cannot accidentally be placed in a non-secure state. Assurance justification Security requirements 2 4 Design 1 3 Implementation Design and implementation refinement INFSCI 2935: Introduction to Computer Security 47 INFSCI 2935: Introduction to Computer Security 48 24
25 Life Cycle Conception Manufacture Deployment Fielded Product Life Conception Idea Decisions to pursue it Proof of concept See if idea has merit Rapid prototyping, analysis, etc. High-level requirements analysis What does secure mean for this concept? Identify threats Is it possible for this concept to meet this meaning of security? Is the organization willing to support the additional resources required to make this concept meet this meaning of security? INFSCI 2935: Introduction to Computer Security 49 INFSCI 2935: Introduction to Computer Security 50 25
26 Manufacture Deployment Develop detailed plans for each group involved May depend on use; internal product requires no sales Plans: marketing, sales training, development, testing Software development and engineering process Implement the plans to create entity Includes decisions whether to proceed, for example due to market needs May be the longest stage Delivery Assure that correct (assured) masters are delivered to production and protected Distribute to customers, sales organizations Installation and configuration Developers must ensure that the system operates properly in the production environment INFSCI 2935: Introduction to Computer Security 51 INFSCI 2935: Introduction to Computer Security 52 26
27 Fielded Product Life Routine maintenance, patching Responsibility of engineering in small organizations Responsibility may be in different group than one that manufactures product Customer service, support organizations Answering questions; recording bugs Retirement or decommission of product Migration plans for customers Waterfall Life Cycle Model Requirements definition and analysis Functional and non-functional General (for customer), specifications System and software design Implementation and unit testing Integration and system testing Operation and maintenance INFSCI 2935: Introduction to Computer Security 53 INFSCI 2935: Introduction to Computer Security 54 27
28 Relationship of Stages Other Models of Software Development Requirements definition and analysis System and software design Implementation and unit testing Integration and system testing Operation and maintenance Exploratory programming Develop working system quickly Used when detailed requirements specification cannot be formulated in advance, and adequacy is goal No requirements or design specification, so low assurance Prototyping (Similar to Exploratory) Prototyping (Similar to Exploratory) Objective is to establish system requirements Future iterations (after first) allow assurance techniques INFSCI 2935: Introduction to Computer Security 55 INFSCI 2935: Introduction to Computer Security 56 28
29 Models Models Formal transformation Create formal specification Translate it into program using correctnesspreserving transformations Very conducive to assurance methods System assembly from reusable components Depends on whether components are trusted Must assure connections, composition as well Very complex, difficult to assure This is common approach to building secure and trusted systems Extreme programming Extreme programming Rapid prototyping and best practices Project driven by business decisions Requirements open until project complete Programmers work in teams Components tested, integrated several times a day Objective is to get system into production as quickly as possible, then enhance it Evidence adduced after development needed for assurance INFSCI 2935: Introduction to Computer Security 57 INFSCI 2935: Introduction to Computer Security 58 29
30 Key Points Assurance critical for determining trustworthiness of systems Different levels of assurance, from informal evidence to rigorous mathematical evidence Assurance needed at all stages of system life cycle INFSCI 2935: Introduction to Computer Security 59 INFSCI 2935: Introduction to Computer Security 60 30
Introduction to Assurance
Introduction to Assurance Overview Why assurance? Trust and assurance Life cycle and assurance April 1, 2015 Slide #1 Overview Trust Problems from lack of assurance Types of assurance Life cycle and assurance
More informationL17: Assurance. Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806
L17: Assurance Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806 11/06/2015 CSCI 451 - Fall 2015 1 Acknowledgement Many slides are from or are revised
More informationAmplifying. Only stack module can alter, read x So process doesn t get capability, but needs it when x is referenced a problem!
Amplifying Allows temporary increase of privileges Needed for modular programming Module pushes, pops data onto stack module stack endmodule. Variable x declared of type stack var x: module; Only stack
More informationAmplifying. Examples
Amplifying Allows temporary increase of privileges Needed for modular programming Module pushes, pops data onto stack module stack endmodule. Variable x declared of type stack var x: module; Only stack
More informationInformation Security & Privacy
IS 2150 / TEL 2810 Information Security & Privacy James Joshi Associate Professor, SIS Lecture 2 Sept 4, 2013 Key Management Network Security 1 Objectives Understand/explain the issues related to, and
More informationLecture 33. Firewalls. Firewall Locations in the Network. Castle and Moat Analogy. Firewall Types. Firewall: Illustration. Security April 15, 2005
Firewalls Lecture 33 Security April 15, 2005 Idea: separate local network from the Internet Trusted hosts and networks Intranet Firewall DMZ Router Demilitarized Zone: publicly accessible servers and networks
More informationIPSec. Slides by Vitaly Shmatikov UT Austin. slide 1
IPSec Slides by Vitaly Shmatikov UT Austin slide 1 TCP/IP Example slide 2 IP Security Issues Eavesdropping Modification of packets in transit Identity spoofing (forged source IP addresses) Denial of service
More informationCIS 6930/4930 Computer and Network Security. Topic 8.1 IPsec
CIS 6930/4930 Computer and Network Security Topic 8.1 IPsec 1 IPsec Objectives Why do we need IPsec? IP V4 has no authentication IP spoofing Payload could be changed without detection. IP V4 has no confidentiality
More informationCSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Security in Network Layer Implementing security in application layer provides flexibility in security
More informationIPSec. Overview. Overview. Levente Buttyán
IPSec - brief overview - security associations (SAs) - Authentication Header (AH) protocol - Encapsulated Security Payload () protocol - combining SAs (examples) Overview Overview IPSec is an Internet
More informationCryptography and Network Security. Sixth Edition by William Stallings
Cryptography and Network Security Sixth Edition by William Stallings Chapter 20 IP Security If a secret piece of news is divulged by a spy before the time is ripe, he must be put to death, together with
More informationIP Security. Have a range of application specific security mechanisms
IP Security IP Security Have a range of application specific security mechanisms eg. S/MIME, PGP, Kerberos, SSL/HTTPS However there are security concerns that cut across protocol layers Would like security
More informationInternet Security. - IPSec, SSL/TLS, SRTP - 29th. Oct Lee, Choongho
Internet Security - IPSec, SSL/TLS, SRTP - 29th. Oct. 2007 Lee, Choongho chlee@mmlab.snu.ac.kr Contents Introduction IPSec SSL / TLS SRTP Conclusion 2/27 Introduction (1/2) Security Goals Confidentiality
More informationCSE509: (Intro to) Systems Security
CSE509: (Intro to) Systems Security Fall 2012 Invited Lecture by Vyas Sekar IPSec 2005-12 parts by Matt Bishop, used with permission Security in Real Life: Motivation Site SF Company X $$$ Site NY Site
More informationInt ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
More informationThe IPsec protocols. Overview
The IPsec protocols -- components and services -- modes of operation -- Security Associations -- Authenticated Header (AH) -- Encapsulated Security Payload () (c) Levente Buttyán (buttyan@crysys.hu) Overview
More informationLehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München. ilab. Lab 8 SSL/TLS and IPSec
Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München ilab Lab 8 SSL/TLS and IPSec Outlook: On Layer 4: Goal: Provide security for one specific port SSL
More informationComputer Security 3e. Dieter Gollmann. Security.di.unimi.it/sicurezza1415/ Chapter 16: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/sicurezza1415/ Chapter 16: 1 Chapter 16: Communications Security Chapter 16: 2 Agenda Threat model Secure tunnels Protocol design principles IPsec
More informationThe World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
More informationChapter 32 Security in the Internet: IPSec, SSL/TLS, PGP,
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls 32.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 32.2 Figure 32.1 Common structure
More informationThe Internet community has developed application-specific security mechanisms in a number of application areas, including electronic mail (S/MIME,
1 The Internet community has developed application-specific security mechanisms in a number of application areas, including electronic mail (S/MIME, PGP), client/server (Kerberos), Web access (Secure Sockets
More informationCSC 6575: Internet Security Fall 2017
CSC 6575: Internet Security Fall 2017 Network Security Devices IP Security Mohammad Ashiqur Rahman Department of Computer Science College of Engineering Tennessee Tech University 2 IPSec Agenda Architecture
More informationTransport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
More informationTransport Layer Security
CEN585 Computer and Network Security Transport Layer Security Dr. Mostafa Dahshan Department of Computer Engineering College of Computer and Information Sciences King Saud University mdahshan@ksu.edu.sa
More informationCS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
More informationCryptography and Network Security Chapter 16. Fourth Edition by William Stallings
Cryptography and Network Security Chapter 16 Fourth Edition by William Stallings Chapter 16 IP Security If a secret piece of news is divulged by a spy before the time is ripe, he must be put to death,
More informationAIT 682: Network and Systems Security
AIT 682: Network and Systems Security Final Exam Review Instructor: Dr. Kun Sun Topics covered by Final Topic before Midterm 10% Topic after Midterm 90% Date: 12/13/2017 7:30am 10:15am Place: the same
More informationIP Security. Cunsheng Ding HKUST, Kong Kong, China
IP Security Cunsheng Ding HKUST, Kong Kong, China Agenda Some attacks against the IP Brief introduction to IPSec Building Block: Security Association Building Block: Security Association Database Building
More informationService Managed Gateway TM. Configuring IPSec VPN
Service Managed Gateway TM Configuring IPSec VPN Issue 1.2 Date 12 November 2010 1: Introduction 1 Introduction... 3 1.1 What is a VPN?... 3 1.2 The benefits of an Internet-based VPN... 3 1.3 Tunnelling
More informationCyberP3i Course Module Series
CyberP3i Course Module Series Spring 2017 Designer: Dr. Lixin Wang, Associate Professor Firewall Configuration Firewall Configuration Learning Objectives 1. Be familiar with firewalls and types of firewalls
More informationDistributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
More informationCOSC4377. Chapter 8 roadmap
Lecture 28 Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7
More informationProtocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
More informationNetwork Security: IPsec. Tuomas Aura
Network Security: IPsec Tuomas Aura 3 IPsec architecture and protocols Internet protocol security (IPsec) Network-layer security protocol Protects IP packets between two hosts or gateways Transparent to
More informationCryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 15 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear,
More informationProtocol Architecture (2) Suguru Yamaguchi Nara Institute of Science and Technology Department of Information Science
Protocol Architecture (2) Suguru Yamaguchi Nara Institute of Science and Technology Department of Information Science History of computer network protocol development in 20 th century. Development of hierarchical
More informationSecurity Engineering. Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings)
Security Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings) Lecture Outline Network Attacks Attive Attacks Passive Attacks TCP Attacks Contermeasures IPSec SSL/TLS Firewalls
More informationIP Security IK2218/EP2120
IP Security IK2218/EP2120 Markus Hidell, mahidell@kth.se KTH School of ICT Based partly on material by Vitaly Shmatikov, Univ. of Texas Acknowledgements The presentation builds upon material from - Previous
More informationChapter 5: Network Layer Security
Managing and Securing Computer Networks Guy Leduc Mainly based on Network Security - PRIVATE Communication in a PUBLIC World C. Kaufman, R. Pearlman, M. Speciner Pearson Education, 2002. (chapters 17 and
More informationChapter 6. IP Security. Dr. BHARGAVI H. GOSWAMI Department of Computer Science Christ University
Chapter 6 IP Security Dr. BHARGAVI H. GOSWAMI Department of Computer Science Christ University +91 9426669020 bhargavigoswami@gmail.com Topic List 1. IP Security Overview 2. IP Security Architecture 3.
More informationCSE543 Computer and Network Security Module: Network Security
CSE543 Computer and Network Security Module: Network Security Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 2 Communication Security Want to establish a secure channel
More informationAgenda. Introduction. Security Protocols Wireless / Mobile Security. Lecture 10. Network Security I
Lecture 10 Network Security I Information and Communications Security (SS 2008) Prof. Dr. Kai Rannenberg T-Mobile Chair for Mobile Business & Multilateral Security Johann Wolfgang Goethe University Frankfurt
More information... Lecture 10. Network Security I. Information & Communication Security. Prof. Dr. Kai Rannenberg
Lecture 10 Network Security I Information & Communication Security (SS 2011) Prof. Dr. Kai Rannenberg T-Mobile Chair of Mobile Business & Multilateral Security Goethe University Frankfurt a. M. Agenda
More informationHP Instant Support Enterprise Edition (ISEE) Security overview
HP Instant Support Enterprise Edition (ISEE) Security overview Advanced Configuration A.03.50 Mike Brandon Interex 03 / 30, 2004 2003 Hewlett-Packard Development Company, L.P. The information contained
More informationFirewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
More informationApplication Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder )
Application Note Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) This document describes how to configure McAfee Firewall Enterprise to provide
More informationChapter 6/8. IP Security
Chapter 6/8 IP Security Prof. Bhargavi H Goswami Department of MCA, Sunshine Group of Institutes, Rajkot, Gujarat, India. Mob: +918140099018. Email: bhargavigoswami@gmail.com Topic List 1. IP Security
More informationINF3510 Information Security University of Oslo Spring Lecture 9 Communication Security. Audun Jøsang
INF3510 Information Security University of Oslo Spring 2011 Lecture 9 Communication Security Audun Jøsang Outline Network security concepts Communication security Perimeter security Protocol architecture
More informationComputer Security 3e. Dieter Gollmann. Security.di.unimi.it/sicurezza1516/ Chapter 16: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/sicurezza1516/ Chapter 16: 1 Chapter 16: Communications Security Chapter 16: 2 Agenda Threat model Secure tunnels Protocol design principles IPsec
More informationAdvanced Security and Mobile Networks
WJ Buchanan. ASMN (1) Advanced Security and Mobile Networks Unit 1: Network Security Application Presentation Session Transport Network Data Link Physical OSI Application Transport Internet Internet model
More informationNetwork Encryption 3 4/20/17
The Network Layer Network Encryption 3 CSC362, Information Security most of the security mechanisms we have surveyed were developed for application- specific needs electronic mail: PGP, S/MIME client/server
More informationCSC Network Security
CSC 474 -- Security Topic 9. Firewalls CSC 474 Dr. Peng Ning 1 Outline Overview of Firewalls Filtering Firewalls Proxy Servers CSC 474 Dr. Peng Ning 2 Overview of Firewalls CSC 474 Dr. Peng Ning 3 1 Internet
More informationNetwork Security - ISA 656 IPsec IPsec Key Management (IKE)
Network Security - ISA 656 IPsec IPsec (IKE) Angelos Stavrou September 28, 2008 What is IPsec, and Why? What is IPsec, and Why? History IPsec Structure Packet Layout Header (AH) AH Layout Encapsulating
More informationLecture 9: Network Level Security IPSec
Lecture 9: Network Level Security IPSec CS 336/536: Computer Network Security Fall 2015 Nitesh Saxena Adopted from previous lecture by Keith Ross, and Tony Barnard HW3 being graded Course Admin HW4 will
More informationIntroduction to Security
IS 2150 / TEL 2810 Introduction to Security James Joshi Professor, SIS Lecture 12 2016 Intrusion Detection, Auditing System Firewalls & VPN 1 Intrusion Detection 2 Intrusion Detection/Response Denning:
More informationVirtual Private Network
VPN and IPsec Virtual Private Network Creates a secure tunnel over a public network Client to firewall Router to router Firewall to firewall Uses the Internet as the public backbone to access a secure
More informationVPN and IPsec. Network Administration Using Linux. Virtual Private Network and IPSec 04/2009
VPN and IPsec Network Administration Using Linux Virtual Private Network and IPSec 04/2009 What is VPN? VPN is an emulation of a private Wide Area Network (WAN) using shared or public IP facilities. A
More informationCryptography and secure channel. May 17, Networks and Security. Thibault Debatty. Outline. Cryptography. Public-key encryption
and secure channel May 17, 2018 1 / 45 1 2 3 4 5 2 / 45 Introduction Simplified model for and decryption key decryption key plain text X KE algorithm KD Y = E(KE, X ) decryption ciphertext algorithm X
More informationCSC 4900 Computer Networks: Security Protocols (2)
CSC 4900 Computer Networks: Security Protocols (2) Professor Henry Carter Fall 2017 Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message Integrity 8.4 End point Authentication
More informationCSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Web Security Web is now widely used by business, government, and individuals But Internet and Web are
More informationIPsec and SSL/TLS. Applied Cryptography. Andreas Hülsing (Slides mostly by Ruben Niederhagen) Dec. 1st, /43
0/43 IPsec and SSL/TLS Applied Cryptography 0 Andreas Hülsing (Slides mostly by Ruben Niederhagen) Dec. 1st, 2016 Cryptography in the TCP/IP stack application layer transport layer network layer data-link
More informationINTERNET PROTOCOL SECURITY (IPSEC) GUIDE.
INTERNET PROTOCOL SECURITY (IPSEC) GUIDE www.insidesecure.com INTRODUCING IPSEC NETWORK LAYER PACKET SECURITY With the explosive growth of the Internet, more and more enterprises are looking towards building
More informationNetwork Security Fundamentals
Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University of Michigan 2013 Network Security Fundamentals Module 6 Firewalls & VPNs Topics Firewall Fundamentals Case
More informationIP Security Part 1 04/02/06. Hofstra University Network Security Course, CSC290A
Network Security IP Security Part 1 1 IP Security Overview 1994 RFC1636, Security in the Internet Architecture Identified key needs: Secure network infrastructure from unauthorized monitoring Control network
More informationChapter 10: Cipher Techniques
Chapter 10: Cipher Techniques Some Problems Types of Ciphers Networks Examples Slide #10-1 Overview Problems What can go wrong if you naively use ciphers Cipher types Stream or block ciphers? Networks
More informationSample excerpt. Virtual Private Networks. Contents
Contents Overview...................................................... 7-3.................................................... 7-5 Overview of...................................... 7-5 IPsec Headers...........................................
More informationNetwork Security and Cryptography. 2 September Marking Scheme
Network Security and Cryptography 2 September 2015 Marking Scheme This marking scheme has been prepared as a guide only to markers. This is not a set of model answers, or the exclusive answers to the questions,
More informationIPsec (AH, ESP), IKE. Guevara Noubir CSG254: Network Security
IPsec (AH, ESP), IKE Guevara Noubir noubir@ccs.neu.edu Securing Networks Control/Management (configuration) Applications Layer telnet/ftp: ssh, http: https, mail: PGP (SSL/TLS) Transport Layer (TCP) (IPSec,
More informationIndicate whether the statement is true or false.
Indicate whether the statement is true or false. 1. Packet-filtering firewalls scan network data packets looking for compliance with the rules of the firewall s database or violations of those rules. 2.
More informationIS-2150/TEL-2810 Introduction to Computer Security Quiz 2 Thursday, Dec 14, 2006
IS-2150/TEL-2810 Introduction to Computer Security Quiz 2 Thursday, Dec 14, 2006 Name: Email: Total Time : 1:00 Hour Total Score : 100 There are three parts. Part I is worth 20 points. Part II is worth
More informationNetwork Security and Cryptography. December Sample Exam Marking Scheme
Network Security and Cryptography December 2015 Sample Exam Marking Scheme This marking scheme has been prepared as a guide only to markers. This is not a set of model answers, or the exclusive answers
More informationOn the Internet, nobody knows you re a dog.
On the Internet, nobody knows you re a dog. THREATS TO DISTRIBUTED APPLICATIONS 1 Jane Q. Public Big Bank client s How do I know I am connecting to my bank? server s Maybe an attacker...... sends you phishing
More informationChapter 8 Network Security
Chapter 8 Network Security A note on the use of these ppt slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you can add, modify, and
More informationVirtual Private Networks.
Virtual Private Networks thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/ Content Virtual Private Networks VPN Basics Protocols (IPSec, PPTP, L2TP) Objectives of VPNs Earlier Companies
More informationInternet security and privacy
Internet security and privacy IPsec 1 Layer 3 App. TCP/UDP IP L2 L1 2 Operating system layers App. TCP/UDP IP L2 L1 User process Kernel process Interface specific Socket API Device driver 3 IPsec Create
More informationOverview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL ensures the secure transmission of data between a client and a server through
More informationHUAWEI USG6000 Series Next-Generation Firewall Technical White Paper VPN HUAWEI TECHNOLOGIES CO., LTD. Issue 1.1. Date
HUAWEI USG6000 Series Next-Generation Firewall Technical White Paper VPN Issue 1.1 Date 2014-03-14 HUAWEI TECHNOLOGIES CO., LTD. 2014. All rights reserved. No part of this document may be reproduced or
More informationNetwork Security: IPsec. Tuomas Aura T Network security Aalto University, Nov-Dec 2014
Network Security: IPsec Tuomas Aura T-110.5241 Network security Aalto University, Nov-Dec 2014 2 IPsec: Architecture and protocols Internet protocol security (IPsec) Network-layer security protocol Protects
More informationJunos Security. Chapter 8: IPsec VPNs Juniper Networks, Inc. All rights reserved. Worldwide Education Services
Junos Security Chapter 8: IPsec VPNs 2012 Juniper Networks, Inc. All rights reserved. www.juniper.net Worldwide Education Services Chapter Objectives After successfully completing this chapter, you will
More informationIPSec implementation for SCTP
SCTP and Proposed Modifications to Aditya Kelkar Alok Sontakke Srivatsa R. Dept. of CSE. IIT Bombay October 31, 2004 SCTP and Proposed Modifications to 1 2 3 SCTP and 4 Proposed Modifications to 5 SCTP
More informationActive Directory in Networks Segmented by Firewalls
Active Directory in Networks Segmented by Firewalls Microsoft Corporation Published: July 2002 Updated: October 2004 Abstract Microsoft Active Directory service domain controllers are increasingly being
More informationPROGRAMMING Kyriacou E. Frederick University Cyprus. Network communication examples
ACSC424 NETWORK APPLICATION PROGRAMMING Kyriacou E. Frederick University Cyprus communication examples The OSI reference model (proposed by ISO) Application A Application B 2 Application Application Presentation
More information8. Network Layer Contents
Contents 1 / 43 * Earlier Work * IETF IP sec Working Group * IP Security Protocol * Security Associations * Authentication Header * Encapsulation Security Payload * Internet Key Management Protocol * Modular
More informationSchool of Computer Sciences Universiti Sains Malaysia Pulau Pinang
School of Computer Sciences Universiti Sains Malaysia Pulau Pinang Information Security & Assurance Assignment 2 White Paper Virtual Private Network (VPN) By Lim Teck Boon (107593) Page 1 Table of Content
More informationCTS2134 Introduction to Networking. Module 08: Network Security
CTS2134 Introduction to Networking Module 08: Network Security Denial of Service (DoS) DoS (Denial of Service) attack impacts system availability by flooding the target system with traffic or by exploiting
More informationVPN Auto Provisioning
VPN Auto Provisioning You can configure various types of IPsec VPN policies, such as site-to-site policies, including GroupVPN, and route-based policies. For specific details on the setting for these kinds
More informationWhy Firewalls? Firewall Characteristics
Why Firewalls? Firewalls are effective to: Protect local systems. Protect network-based security threats. Provide secured and controlled access to Internet. Provide restricted and controlled access from
More informationUsing the Terminal Services Gateway Lesson 10
Using the Terminal Services Gateway Lesson 10 Skills Matrix Technology Skill Objective Domain Objective # Deploying a TS Gateway Server Configure Terminal Services Gateway 2.2 Terminal Services (TS) Web
More informationLecture 10: Communications Security
INF3510 Information Security Lecture 10: Communications Security Nils Gruschka University of Oslo Spring 2018 Introduction Nils Gruschka University Kiel (Diploma in Computer Science) T-Systems, Hamburg
More informationVPN World. MENOG 16 Istanbul-Turkey. By Ziad Zubidah Network Security Specialist
VPN World MENOG 16 Istanbul-Turkey By Ziad Zubidah Network Security Specialist What is this Van used for?! Armed Van It used in secure transporting for valuable goods from one place to another. It is bullet
More informationLecture 13 Page 1. Lecture 13 Page 3
IPsec Network Security: IPsec CS 239 Computer Software March 2, 2005 Until recently, the IP protocol had no standards for how to apply security Encryption and authentication layered on top Or provided
More informationSecure channel, VPN and IPsec. stole some slides from Merike Kaeo
Secure channel, VPN and IPsec stole some slides from Merike Kaeo 1 HTTP and Secure Channel HTTP HTTP TLS TCP TCP IP IP 2 SSL and TLS SSL/TLS SSL v3.0 specified
More informationINFS 766 Internet Security Protocols. Lectures 7 and 8 IPSEC. Prof. Ravi Sandhu IPSEC ROADMAP
INFS 766 Internet Security Protocols Lectures 7 and 8 IPSEC Prof. Ravi Sandhu IPSEC ROADMAP Security Association IP AH (Authentication Header) Protocol IP ESP (Encapsulating Security Protocol) Authentication
More informationNetworking interview questions
Networking interview questions What is LAN? LAN is a computer network that spans a relatively small area. Most LANs are confined to a single building or group of buildings. However, one LAN can be connected
More informationSonicOS Enhanced Release Notes
SonicOS Contents Platform Compatibility... 1 Known Issues... 2 Resolved Known Issues... 3 Upgrading SonicOS Enhanced Image Procedures... 5 Related Technical Documentation...8 Platform Compatibility The
More informationNetwork Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
More informationCSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 20: Intrusion Prevention Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Firewalls purpose types locations Network perimeter
More informationVPNs and VPN Technologies
C H A P T E R 1 VPNs and VPN Technologies This chapter defines virtual private networks (VPNs) and explores fundamental Internet Protocol Security (IPSec) technologies. This chapter covers the following
More informationFirepower Threat Defense Site-to-site VPNs
About, on page 1 Managing, on page 3 Configuring, on page 3 Monitoring Firepower Threat Defense VPNs, on page 11 About Firepower Threat Defense site-to-site VPN supports the following features: Both IPsec
More informationHP A-F1000-A-EI_A-F1000-S-EI VPN Firewalls
HP A-F1000-A-EI_A-F1000-S-EI VPN Firewalls VPN Configuration Guide Part number:5998-2652 Document version: 6PW100-20110909 Legal and notice information Copyright 2011 Hewlett-Packard Development Company,
More information