Network security
Download as PPT, PDF2 likes165 views
This document provides an overview of network security concepts including cryptography, digital signatures, security at various layers, and firewalls. It discusses cryptography principles like plaintext, ciphertext, and keys. Symmetric and asymmetric key cryptography algorithms are explained along with digital signatures and hashing. Network layer security standards like IPsec and its authentication header and encapsulating security payload are described. Transport layer security including TLS handshake, alert, and cipher protocols is also summarized. The roles and types of firewalls in providing access control between networks are defined.
Network security
- 1. NETWORK SECURITY name- anoop negi roll no- 27 Date: 4-04-2016
- 2. CONTENTS understand principles of network security: cryptography Digital Signatures Security at Various Layers Firewalls
- 3. INTRODUCTION Cryptography is the study of creating and using encryption and decryption techniques. Plaintext is the the data that before any encryption has been performed. Ciphertext is the data after encryption has been performed. The key is the unique piece of information that is used to create ciphertext and decrypt the ciphertext back into plaintext.
- 4. KEY TERMS Confidentiality: only sender, intended receiver should “ understand” message contents sender encrypts message receiver decrypts message Authentication: sender, receiver want to confirm identity of each other Message Integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) . Access and Availability: services must be accessible and available to users
- 5. CONTINUE……….. ❍ eavesdrop: intercept messages ❍ impersonation: can fake (spoof) source address in packet (or any field in packet) ❍ hijacking: “take over” ongoing connection by removing sender or receiver, inserting himself in place
- 6. SYMMETRIC KEY CRYPTOGRAPHY The same key is used by the sender (for encryption) and the receiver (for decryption). The key is shared. Encryption and Decryption Algorithms are public.
- 7. Continue………. substitution cipher: substituting one thing for another. monoalphabetic cipher: substitute one letter for another . plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasdfghjklpoiuytrewq Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc
- 8. Data Encryption Standard Created in 1977 and in operation into the 1990s, the data encryption standard took a 64- bit block of data and subjected it to 16 levels of encryption. The choice of encryption performed at each of the 16 levels depends on the 56-bit key applied. Even though 56 bits provides over 72 quadrillion combinations, a system using this standard has been cracked (in 1998 by Electronic Frontier Foundation in 3 days).
- 9. Continue……….
- 10. Public Key Cryptography Very powerful encryption technique in which two keys are used: the first key (the public key) encrypts the message while the second key (the private key) decrypts the message. Not possible to deduce one key from the other. Not possible to break the code given the public key. If you want someone to send you secure data, give them your public key, you keep the private key. Secure sockets layer on the Internet is a common example of public key cryptography.
- 11. RSA The most common public key algorithm . Private key is a pair of numbers (n,d). Public key is a pair of numbers (n,e). The sender uses the following algorithm to encrypt the message: C=p*pow(e) mod n P=plaintext ,C=cyphertext and e,n are components of public key. Receiver : p=C*pow(d) mod n
- 12. RSA
- 13. Digital Signature Digital signature can provide: Authentication Integrity Nonrepudiation The sender uses her private key to encrypt(sign) the message . The receiver on the other hand uses the public key of sender to decrypt the msg. No need to sign the entire document(digest). Digital signature does not provide privacy.
- 14. Message Digests Computationally expensive to public-key-encrypt long messages. Goal: fixed-length, easy to-compute digital “fingerprint”. apply hash function H to m, get fixed size message digest, H(m). Hash function properties: Hashing is one way: digest can only be created from the msg , not vice versa. Hashing is one to one function: there is little probability that two msg produce same digest.
- 15. SECURITY AT IP LEVEL IP Security (ipsec) is a collection of protocols to provide security for a packet at the IP level. Ipsec requires a logical connection between two hosts using a signalling protocol called Security Association. An SA connection can be simplex or duplex. SA is uniquely defined by three elements: A 32 bit security parameter index (spi),which acts as virtual circuit identifier in connection oriented protocols. The source ip address. The type of protocol used- AH,ESP.
- 16. AUTHENTICATION HEADER (AH) AH provides authentication , integrity and anti-replay for the entire packet(ip header & data payload). It does not provide confidentiality , which means it does not encrypt the data. The data is readable but protected from modification. Integrity and authentication are provided by placement of AH header between the Ip header and transport layer protocol . AH uses an ip protocol id of 51 to identify itself in the IP header.
- 17. AH FIELDS Next Header: Identifies the next header that uses IP protocol id, ex- value might be 6 to indicate tcp. Length: indicate length of AH header. SPI: used in combination with the destination address and security protocol(AH OR ESP) to identify correct security association for the communication. Sequence no. : provides anti-relay protection. It is a 32 bit number that is never allowed to cycle . The receiver checks this field to verify that a packet with this number has not been received yet. If one is received ,the packet is rejected. Authentication data: contains integrity check value to verify the integrity of the msg.
- 18. ENCAPSULATING SECURITY PAYLOAD Provides confidentiality in addition to authentication , integrity and anti-replay. ESP indicates itself in the IP header using IP protocol id of 50. Ex- alice on computer A sends data to bob on computer B. The data payload is encrypted and signed for integrity. Upon receipt the data payload packet is decrypted . Bob can be certain it was really alice who send the data. Also the data is unmodified and no other was able to read it.
- 19. ESP HEADER AND TRAILER FIELD SECURITY PARAMETER INDEX (SPI): same as in AH. Sequence no : same as in AH. Padding : the variable length field of 0’s serves as padding. Padding length: indicates the length of the padding field in bytes. This field is used by the receiver to discard the padding field. Next header: identifies the type of payload tcp or udp. Authentication data: contains the integrity check value(icv) and a msg authentication code that is used to verify the sender’s identity and msg integrity.
- 20. Continue….
- 21. Transport layer security TLS was designed to provide security at transport layer. TLS allows two parties to exchange messages in a secure environment. To accomplish this TLS require that Two parties must agree on 3 protocols : an entity authentication protocol, a message authentication protocol and encrypt/decrypt protocol. TLS has two layers. The top layer includes three protocols ,one for session setup(handshaking),one for alerting the other party of unusual situation, and one informing the establishment of security parameters. The lower layer ,the record protocol ,is used to encapsulate msg from the upper layer.
- 23. Alert protocol The alert protocol is used to signal an error or a potential error to other party. The packet exchanged defines the severity level of the condition.
- 24. Change cipher spee protocol This protocol is designed to activate the security services (message authentication and encryption/decryption) after all the agreements are confirmed in the handshake protocol. After exchanging the one message defined in this protocol ,the two parties can use the services.
- 25. FIREWALLS A system or combination of systems that supports an access control policy between two networks. A firewall can limit the types of transactions that enter a system, as well as the types of transactions that leave a system. Firewalls can be programmed to stop certain types or ranges of IP addresses, as well as certain types of TCP port numbers (applications). A packet filter firewall is essentially a router that has been programmed to filter out or allow to pass certain IP addresses or TCP port numbers. A proxy server is a more advanced firewall that acts as a doorman into a corporate network. Any external transaction that request something from the corporate network must enter through the proxy server. Proxy servers are more advanced but make external accesses slower.
- 26. THANK YOU