CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina
Security in Network Layer Implementing security in application layer provides flexibility in security policy and key management Problem is the need to implement security mechanism in every application individually To reduce the overhead, we can implement security in network layer to provide security for all applications between selected pair of computers 02/22/2017 2
IPSec Current security standard for IP layer Provide general security services for IP Authentication Confidentiality Anti-replay Key management Applicable to use over LANs, across public and private WANs, and for the Internet 02/22/2017 3
Scenario of IPSec Uses 02/22/2017 4
Benefits of IPSec Provide strong security to all traffic crossing the perimeter if installed in a firewall/router Resistant to bypass IPSec is below transport layer, hence transparent to applications Can be transparent to end users Can provide security for individual users if desired 02/22/2017 5
IP Security Architecture Specification is quite complex Defined in numerous RFC s Latest version in RFC 4301/4302/4303/4306 many others, grouped by category Two protocols Authentication Header (AH) Encapsulating Security Payload (ESP) Mandatory in IPv6, optional in IPv4 02/22/2017 6
IP Security Architecture 02/22/2017 7
Transport Mode and Tunnel Mode Transport mode provides protection for upper-layer protocols, namely on the payload of an IP packet Suitable for end-to-end communication between two hosts Tunnel mode provides protection to the entire IP packet Entire packet plus security fields is treated as the payload of new outer IP packet with new outer IP header Suitable when one or both ends of SA are a security gateway 02/22/2017 8
Security Association (SA) A unidirectional relationship between sender and receiver that affords security for traffic flow Each IPSec computer maintains a database of SA s Defined by 3 parameters Security Parameters Index (SPI) IP Destination Address Security Protocol Identifier 02/22/2017 9
SA Parameters Sequence Number Counter Sequence Number Overflow Anti-Replay Window AH and ESP information Lifetime IPSec Protocol Mode Path MTU 02/22/2017 10
Security Policy Database Used to relate IP traffic to specific SAs (or no SA if the given traffic is allowed to bypass IPsec) Each SPD entry is defined by selectors, which are a set of IP and upper-layer protocol field values Remote IP address Local IP address Next layer protocol Name Local and remote ports 02/22/2017 11
SPD Example Protocol Local IP Port Remote IP Port Action Comment UDP 1.2.3.101 500 * 500 BYPASS IKE ICMP 1.2.3.101 * * * BYPASS Error message * 1.2.3.101 * 1.2.3.0/24 * PROTECT: ESP intransport-mode TCP 1.2.3.101 * 1.2.4.10 80 PROTECT: ESP intransport-mode Encrypt intranet traffic Encrypt to server TCP 1.2.3.101 * 1.2.4.10 443 BYPASS TLS: avoid double encryption * 1.2.3.101 * 1.2.4.0/24 * DISCARD Others in DMZ * 1.2.3.101 * * * BYPASS Internet 02/22/2017 12
IP Traffic Processing: Outbound Packets 02/22/2017 13
IP Traffic Processing: Inbound Packets 02/22/2017 14
Authentication Header (AH) Provide support for data integrity and authentication of IP packets end system/router can authenticate user/app prevent address spoofing attacks guard against replay attacks by tracking sequence numbers Based on use of a MAC HMAC-MD5-96 or HMAC-SHA-1-96 MAC is calculated over IP header fields that are either immutable or predictable, AH header other than authentication data, and entire upper-level protocol data Parties must share a secret key 02/22/2017 15
IPv4 Header 02/22/2017 16
Authentication Header 02/22/2017 17
Transport vs Tunnel Mode AH Transport mode is used to authenticate IP payload and selected portion of IP header good for host-to-host traffic Tunnel mode authenticates entire IP packet and selected portion of outer IP header good for VPNs, gateway-to-gateway security 02/22/2017 18
Encapsulating Security Payload (ESP) Provide message content confidentiality and limited traffic flow confidentiality Can optionally provide the same authentication services as AH Support a variety of ciphers, modes, padding AES, Triple-DES, RC5, IDEA, CAST etc CBC most common pad to meet blocksize, for traffic flow 02/22/2017 19
Encapsulating Security Payload 02/22/2017 20
Padding Serve several purposes expand the plaintext to required length make Pad Length and Next Header fields aligned to 32-bit word boundary conceal actual length of payload 02/22/2017 21
Transport vs Tunnel Mode ESP Transport mode is used to encrypt and optionally authenticate IP data data protected but header left in clear can suffer from traffic analysis but is efficient good for ESP host-to-host traffic Tunnel mode encrypts entire IP packet add new header for next hop can counter traffic analysis good for VPNs, gateway-to-gateway security 02/22/2017 22
Transport vs Tunnel Mode ESP 02/22/2017 23
Scope of ESP Encryption and Authentication 02/22/2017 24
Scope of ESP Encryption and Authentication 02/22/2017 25
Protocol Operation for ESP 02/22/2017 26
Combining Security Associations SAs can implement either AH or ESP, but each SA can implement only one Some traffic flows may require services of both AH and ESP, while some other flows may require both transport and tunnel modes To address these concerns, need to combine SAs to form a security association bundle 02/22/2017 27
Authentication plus Confidentiality Which one first? Three approaches to consider ESP with Authentication Option Transport mode or tunnel mode Authentication after encryption Transport Adjacency A bundle of two transport SAs, with the inner being an ESP SA and the outer being an AH SA Authentication after encryption Transport-Tunnel Bundle A bundle consisting of an inner AH transport SA and an outer ESP tunnel SA Authentication before encryption 02/22/2017 28
Combining Security Associations 02/22/2017 29
Key Management Handle key generation and distribution Typically need 2 pairs of keys 2 per direction (for AH & ESP) Manual key management sysadmin manually configures every system Automated key management automated system for on demand creation of keys for SA s in large systems Oakley and ISAKMP are two essential elements IKEv2 does not use the terms Oakley and ISAKMP but basic functionality is the same 02/22/2017 30
IKE Key Determination (OAKLEY) A key exchange protocol Based on Diffie-Hellman key exchange Add features to address weaknesses of Diffie- Hellman cookies to counter clogging attacks nonces to counter replay attacks key exchange authentication to counter man-inthe-middle attacks Can use arithmetic in prime fields or elliptic curve fields 02/22/2017 31
Usage of Cookies Three basic requirements Must depend on specific parties Impossible for anyone other than issuing entity to generate cookies that will be accepted by issuing entity Cookie generation and verification must be fast To create a cookie, perform a fast hash over src and dst IP addresses, src and dst ports, and a locally generated secret value 02/22/2017 32
ISAKMP Internet Security Association and Key Management Protocol Provide framework for key management Define procedures and packet formats to establish, negotiate, modify, and delete SAs Independent of any specific key exchange protocol, encryption algorithm, and authentication method 02/22/2017 33
IKE Header 02/22/2017 34
IKE Payload 02/22/2017 35
IKE Exchange 02/22/2017 36
02/22/2017 37
Next Class Denial-of-Service (DoS) attack Hop Integrity 02/22/2017 38