Ipsecurity
Download as PPTX, PDF•5 likes•1,132 views
Internet protocol security (IPSec) is a protocol suite that authenticates and encrypts IP packets between communicating devices. It operates at the network layer and is transparent to applications. IPSec uses two security protocols: the Authentication Header protocol (AH) which provides data integrity and authentication, and the Encapsulating Security Payload (ESP) protocol which provides confidentiality, integrity, and authentication. IPSec can operate in either transport mode between hosts or tunnel mode between gateways to provide a virtual private network.
Ipsecurity
- 1. Internet protocol security (ipsec) Prepared ByNishithModi(09BCE029)Chinmay Patel (09BCE038)
- 2. Flow of presentation Introduction
- 3. Benefits of Ipsec
- 4. Modes of operation
- 6. Limitation of IPsec Need for IPSEC...IP Packets have no inherent security. It is Relatively easy to forge the addresses of IP packets, modify the contents of ip packets, replay old packets, and inspect the contents of Ip packets in transit. Therefore there is no guarantee that IP datagrams received are From the claimed senderThat they contain the original data that the sender placed in themThat the original data was not inspected by a third party while the packet was being sent from source to destination. IPSec is a method of protecting IP datagrams. It provides a standard , robust, extensible mechanism in which to provide security to IP and upper-layer protocols.introductionIPSecurity (IPSec) is a collection of protocols designed by the Internet Engineering Task Force (IETF) to provide security for a packet at the network level.
- 7. In common structure of any security protocols , we need to know which algorithm is used for authentication and encryption/decryption.Common structure of security protocols
- 8. Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.
- 10. general IP Security mechanisms provides
- 11. authentication
- 12. confidentiality
- 13. key management
- 14. applicable to use over LANs, across public & private WANs, & for the InternetIPSEC uses
- 15. Benefits of ipsecin a firewall/router provides strong security to all traffic crossing the perimeter
- 16. is resistant to bypass
- 17. is below transport layer, hence transparent to applications
- 18. can be transparent to end users
- 19. can provide security for individual users if desired
- 20. additionally in routing applications:
- 21. assure that router advertisments come from authorized routers
- 22. neighbor advertisments come from authorized routers
- 23. insure redirect messages come from the router to which initial packet was sent
- 24. insure no forging of router updatesIpsec servicesAccess control
- 27. Rejection of replayed packets
- 28. a form of partial sequence integrity
- 30. Limited traffic flow confidentiality Modes of operationIPsec can be implemented in a two modes:-Host-to-host transport modeNetwork tunnel mode.
- 31. transport modeTransport mode provides secure connection between two end-points because only the payload (the data you transfer) of the IP packet is usually encrypted and/or authenticated.
- 32. IPsec in transport mode does not protect Ipheader.It protects what is delivered from the transport layer to the network layer.
- 33. In this mode,theIpsec header and tailer are added to the information coming from the transport layer.The IP header is added later.
- 34. It’s simply a secured IP connection. transport mode in action
- 35. Tunnel modeTunnel Mode encapsulates the entire IP packet to provide a virtual "secure hop" between two gateways.Thus it protects the entire IP packet.
- 36. Tunnel mode is used when either the sender or the receiver is not a host.
- 37. Tunnel mode is more typically used between gateways (routers, firewalls, or standalone VPN devices) to provide a Virtual Private Network (VPN).A secure tunnel is created across an untrusted internet. Tunnel mode in action
- 38. security ASSOCIATIONdefined by 3 parameters:
- 39. Security Parameters Index (SPI)
- 40. a bit string
- 43. could one-way relationship between sender & receiver that affords security for traffic flow
- 44. d be end user, firewall, router
- 46. indicates if SA is AH or ESP
- 47. has a number of other parameters
- 48. seq no, AH & EH info, lifetime etc
- 49. have a database of Security AssociationsTwo protocols are used to provide security:AUTHENTICATION HEADER PROTOCOLS (AH)
- 50. ENCAPSULATION SECURITY PAYLOAD (ESP)Authentication header protocol(ah)AH protocol is designed to authenticate the source host, to ensure integrity all or part of the contents of a datagram carried in the IP packet and to guard against replay by attackers.
- 51. It uses a hash function and a symmetric key to create message authentication code.
- 52. It can be considered analogous to the algorithms used to calculate checksums or perform CRC checks for error detection.
- 53. But here AH use a special hashing algorithm and a specific key known only to the source and the destination.AH performs the computation and puts the result (Integrity Check Value or ICV) into a special header with other fields for transmission.
- 54. The destination device does the same calculation using the key the two devices share, which enables it to see immediately if any of the fields in the original datagram were modified (either due to error).
- 55. ICV does not change the original data.
- 56. Thus the presence of the AH header allows us to verify the integrity of the message, but doesn't encrypt it. Thus, AH provides authentication but not privacy .AH protocol can be implemented in two mode tunnel mode and transport mode.
- 57. AH packet is identified by the protocol field of an IPv4 header and the “Next Header” field of an IPv6 header. It’s IP protocol number is 51.AH Protocol in transport mode
- 58. The addition of an AH follows following steps:An authentication header is added to the payload with the authentication data field set to 0.Padding is added for hashing function to make length even.Hashing is based on the total packet.Those fields of the IP header which do not change during transmission are included in calculation. (authentication data).They are inserted in AH.The IP header is added after the value of the protocol field is changed to 51.
- 62. ENCAPSULATION SECURITY PAYLOAD (ESP)Encapsulating Security Payload (ESP) is a member of the IPsec protocol suite. Encryption makes ESP bit more complicated.
- 63. ESP provides source authentication, data integrity and privacy(confidentiality) and also provides protection against replay attacks.
- 64. ESP also supports encryption-only and authentication-only configurations, but using encryption without authentication is strongly discouraged because it is insecure.Like AH ,ESP also operates in two mode of operation:-tunnel mode and transport mode.
- 65. ESP packet is identified by the protocol field of an IPv4 header and the “Next Header” field of an IPv6 header. It’s IP protocol number is 50.
- 66. An encryption algorithm combines the data in the datagram with a key to transform it into an encrypted form.Here symmetric encryption algorithm is applied.It means sender and receiver both have same key.ESP protected IP packet
- 67. The ESP procedure follows following steps:An ESP trailer is added to the payload.The payload and the trailer are encrypted.The ESP header is added.The ESP header,payload and ESP trailer are used to create the authentication data.This data are added after the end of ESP trailer.The IP header is added after the protocol value is changed to 50.
- 68. ENCAPSULATION SECURITY PAYLOAD (ESP)
- 69. ESP has several fields that are the same as those used in AH, but packages its fields in a very different way. Instead of having just a header, it divides its fields into three components:
- 70. ESP Header: This contains two fields, the SPI and Sequence Number, and comes before the encrypted data. Its placement depends on whether ESP is used in transport mode or tunnel mode. ESP Trailer: This section is placed after the encrypted data. It contains padding that is used to align the encrypted data, through a Padding and Pad Length field. Interestingly, it also contains the Next Header field for ESP.
- 71. ESP Authentication Data: This field contains an Integrity Check Value (ICV), computed in a manner similar to how the AH protocol works, for when ESP's optional authentication feature is used. This field provides authentication services similar to those provided by the Authentication Header(AH).There are two reasons why these fields are broken into pieces like this. Some encryption algorithms require the data to be encrypted to have a certain block size, and so padding must appear after the data and not before it. That's why padding appears in the ESP Trailer. The ESP Authentication Data appears separately because it is used to authenticate the rest of the encrypted datagram after encryption. This means it cannot appear in the ESP Header or ESP Trailer. In ESP IP header is not included in calculation of authentication data but in AH it is included.
- 73. Limitation of IPSecIPsec cannot provide the same end-to-end security as systems working at higher levels.
- 74. IPsec encrypts packets at a security gateway machine as they leave the sender's site and decrypts them on arrival at the gateway to the recipient's site. This does provide a useful security service -- only encrypted data is passed over the Internet -- but it does not even come close to providing an end-to-end service. In particular, anyone with appropriate privileges on either site's LAN can intercept the message in unencrypted form.IPsec authenticates machines, not users. IPsec uses strong authentication mechanisms to control which messages go to which machines, but it does not have the concept of user ID, which is vital to many other security mechanisms and policies.
- 75. IPsec does not stop traffic analysis.
- 76. Ipsec provides encryption without authentication using ESP which is very dangerous.
- 77. IPsec does not stop denial of service attacks.This attacks aim at causing a system to crash, overload, or become confused so that legitimate users cannot get whatever services the system is supposed to provide. referencesData communications and networking by BehrouzForouzan
- 78. Computer networks by Andrew Tanenbaum
- 79. Cryptography and Network Security by William Stallings